International Conflict and Cyberspace Superiority

Theory and Practice

William D. Bryant

• Publisher: Routledge
• Year: 2015
• eBook ISBN: 9781317420378
• Topic: Politics & International Relations
• Subtopic: Military & Maritime History
• Index: Politics & International Relations

This book examines cyberspace superiority in nation-state conflict from both a theoretical and a practical perspective.

This volume analyses superiority concepts from the domains of land, maritime, and air to build a model that can be applied to cyberspace. Eight different cyberspace conflicts between nation states are examined and the resulting analysis is combined with theoretical concepts to present the reader with a conclusion. Case studies include the conflict between Russia and Estonia (2007), North Korea and the US and South Korea (2009) and Saudi Arabia and Iran in the Aramco attack (2012). The book uses these case studies to examine cyberspace superiority as an analytical framework to understand conflict in this domain between nation-states. Furthermore, the book makes the important distinction between local and universal domain superiority, and presents a unique model to relate this superiority in all domains, as well as a more detailed model of local superiority in cyberspace. Through examining the eight case studies, the book develops a rigorous system to measure the amount of cyberspace superiority achieved by a combatant in a conflict, and seeks to reveal if cyberspace superiority proves to be a significant advantage for military operations at the tactical, operational, and strategic levels.

This book will be of much interest to students of cyber-conflict, strategic studies, national security, foreign policy and IR in general.

1 Introduction

The importance of cyberspace continues to grow in the modern world. Now it is not just the computer under the desk that is part of cyberspace. We are connecting our cars, phones, kitchen appliances, and even toilets to cyberspace. These connections allow increases in functionality and productivity unimaginable even in the realm of science fiction just a few years ago. Today’s iPhone makes a “Star Trek” communicator look like a caveman’s rock abacus, but the iPhone is the one that actually exists. Unfortunately, just like a “Star Trek” ship’s computer runs amok, our devices may be working against us.

There is a dark side to this ever-increasing connectivity and functionality. Our iPhone can be spying on us and reporting our every move to a foreign intelligence service, our car might be reporting our location to an enemy, and malicious hackers can even take over our humble toilet to humiliate us.¹ Action from cyberspace is not only limited to malicious pranks. Hackers have demonstrated the ability to send potentially lethal commands to common cars, such as the Toyota Prius. One pair of enterprising hackers has demonstrated the capability to blast the horn uncontrollably, “make pathological liars out of speedometers and odometers,” spoof the GPS, and even violently jerk a Prius’ steering at any speed, threatening a potentially lethal collision.² These threats and vulnerabilities become even more magnified as you look at cyberspace systems on the municipal or national level.

Cyberspace is increasingly becoming an arena for nation state conflict. If a nation were to drop a bomb on an enemy power plant, the target nation would consider it an act of war. If the same nation sent a “logic bomb” through cyberspace causing the same amount of damage to the power grid, that is also war. The delivery method does not change the physical effect of the attack. Analysts are increasingly accepting cyberspace as a domain, or discrete region, where combatants fight, much like the domains of land, maritime, air, and space. According to former National Security Council Director for Cyber Security, Gregory Rattray, a goal of U.S. national strategy is to gain control of cyberspace.³ The nature of warfare has not changed, but now there is a new field to fight on, much like when aircraft first opened up the air domain to warfare in the early 1900s. Although the majority of analysts have accepted cyberspace as a domain of warfare, there are some dissenting voices.

I agree with the majority of analysts who think that treating cyberspace as a domain is useful. One well known analyst that takes the opposing view is Martin Libicki who proposes that thinking of cyberspace as a domain causes cyberspace operators to apply inappropriate “warfighting” concepts at the expense of other paradigms such as systems engineering.⁴ There are many reasons I think warfighting is a better mental template for conflict in cyberspace than systems engineering or any other proposed construct, but the most important is that cyberspace conflict is fundamentally human conflict in a new medium. Computers are not attacking each other and trying to steal other computer’s information, people are attacking each other and trying to steal other people’s information using computers. This means that the classic illustration of conflict by Carl von Clausewitz of two wrestlers dynamically reacting to each other applies as much in cyberspace as in the other physical domains.⁵ I contend that thinking of cyberspace as a warfighting domain is far more helpful than thinking of it as an engineering problem and I will more fully develop this topic throughout this book. Some analysts don’t argue that cyberspace is not a domain, they instead argue that war in cyberspace will not happen.

Thomas Rid’s basic thesis is that “cyber war” has not happened, is not happening, and will not happen in the future.⁶ Rid’s thesis is completely dependent upon his definition of “cyber war,” which he defines as having to include the potential to be lethal, “at least for some participants on at least one side.”⁷ I agree with Rid that cyber weapons will not often be the proximate cause of death, although there are a number of scenarios such as crashing a drone into a building where they could be.⁸ I do not agree with Rid that the fact that people are generally not directly killed by cyberspace weapons means we should not think of conflict in cyberspace using theories from warfare. I am also not sure how relevant it is to soldiers who are killed when their positions are overrun because they lost all ability to communicate or call in fire support.

Normally, death and destruction will be dealt out through the physical domains, but that is increasingly facilitated and supported through the cyberspace domain. As a result of its importance, “war” has already started in cyberspace, although I use the term “conflict” to help identify that it is normally not as violent as in the other domains. If cyberspace is different from the other domains in that it is less violent, how else is it different? What is the basic character of this new domain?

Cyberspace is difficult to grasp intuitively because we cannot experience it directly with our senses. We can stand on the land, dive into the water, and see aircraft or satellites with our eyes. To “see” cyberspace we rely on computer screens or diagrams that provide representations, but we are not looking at or experiencing cyberspace directly. Another thing that makes cyberspace difficult to grasp is that it often operates inside or underneath the physical objects we see. According to Professor Chris Demchak, “orchestrating a national security response to cybered threats is hard because cyberspace is hard to see physically in any case, but especially so now as it is deeply embedded in normal societal functions.”⁹ Cyberspace underpins modern society and if it were seriously disrupted, only then would we understand what it had previously been doing for us. In that respect cyberspace in the modern world is like air; people take it for granted and do not think about its importance until it is no longer there. This difficulty in visualizing cyberspace makes careful definition of the domain even more important.

Connections between computing devices create cyberspace. An isolated computer sitting on a desk is no more part of the cyberspace domain than a ship sitting in dry dock is part of the maritime domain. The connections are what matter. The United States Joint Staff has defined cyberspace as “a global domain within the information environment consisting of the interdependent network of information technology infrastructures and resident data, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers.”¹⁰ Although this definition has achieved wide acceptance, one common area of misunderstanding is the relationship between cyberspace and the Internet.

Cyberspace and the Internet are not synonymous, the Internet is a smaller subset of the larger cyberspace. This understanding has important implications for conflict in cyberspace, but the idea of the Internet as cyberspace is widespread. Even Libicki states that, “The Internet is basically tantamount to cyberspace; everything connected to the Internet is connected to cyberspace and, therefore, part of cyberspace.”¹¹ Although everything connected to the Internet is connected to cyberspace, that does not make the Internet tantamount to cyberspace as there are many interdependent networks of information technology infrastructures that are not part of the Internet. Some examples include air gapped systems such as Iran’s nuclear enrichment facilities, as well as embedded processors and controllers in a range of platforms, from cars to satellites. The danger in thinking of cyberspace as the Internet is that non-Internet connected devices are ignored by cyberspace defenders focused on traditional networks, when often those systems are the most critical to protect. Cyberspace is broader than the traditional Internet, but it is not useful to cast it so broadly as to include the entire electromagnetic spectrum.

One point of the definition that analysts still debate is whether to include the electromagnetic spectrum as part of cyberspace. As analysts first developed the concept of cyberspace, some policy makers included the electromagnetic spectrum as cyberspace’s “maneuver space.”¹² However, over time the definition has narrowed “down to the physical network infrastructure used for transmitting and storing information.”¹³ Sean Butler gave the principal reason for this narrowing when he stated that,

The ability to process, store, and exchange large amounts of information rapidly, using automated systems, is the defining characteristic of cyberspace—the physical methods are superficial. In fact, its logical or virtual nature, rather than its physical mechanisms, sets cyberspace apart from other domains.¹⁴

I find this argument compelling and so will use the narrower Joint Staff definition from Information Operations for cyberspace, which does not try to include the entire electromagnetic spectrum.¹⁵ I present a much more detailed analysis of the characteristics of the cyberspace domain in Chapter 3. Now that we have a definition of cyberspace, is freedom of action within that domain significant?

If the cyberspace domain is a key component of modern warfare, then it follows that freedom of action within that domain is important. According to Air Force Doctrine Document (AFDD) 3–12,

Freedom of action in the cyberspace domain enables our command, control, communication, computers, intelligence, surveillance, and reconnaissance capabilities. Our modern defenses, industrial base, and global commerce, as well as that of our nation’s enemies, depend on free use of land, sea, air, space, and cyberspace. Leverage in cyberspace affords influence and control across all other domains. This leverage increases our forces’ access, speed, reach, stealth, and precision.¹⁶

In other domains, and especially in the air and maritime domains, analysts refer to this freedom of action as domain superiority.

The United States Air Force presents a clear definition of cyberspace superiority in Air Force doctrine. According to AFDD 3–12, cyberspace superiority is, “The operational advantage in, through, and from cyberspace to conduct operations at a given time and in a given domain without prohibitive interference.”¹⁷ This definition is the one I will use for cyberspace superiority and it is important to note that cyberspace superiority has an offensive and defensive component. Understanding this dual nature is critical and AFDD 3–12 goes on to provide more context and expand on the simple definition.

Cyberspace superiority may be localized in time and space, or it may be broad and enduring. The concept of cyberspace superiority hinges on the idea of preventing prohibitive interference to joint forces from opposing forces, which would prevent joint forces from creating their desired effects. “Supremacy” prevents effective interference, which does not mean that no interference exists, but that any attempted interference can be countered or should be so negligible as to have little or no effect on operations. While “supremacy” is most desirable, it may not be operationally feasible. Cyberspace superiority, even local or mission-specific cyberspace superiority, may provide sufficient freedom of action to create desired effects. Therefore, commanders should determine the minimum level of control required to accomplish their mission and assign the appropriate level of effort.¹⁸

I will explore a number of important elements in this definition. The first element encompasses the different levels of cyberspace superiority.

There is a wide range of possibilities of how much advantage a combatant can have in a given domain. Note that in the AFDD 3–12 section quoted previously, there are at least two words used to discuss friendly freedom of action, “superiority” and “supremacy.” There are also a large number of terms that authors and thinkers have applied to advantage in a domain that includes command, control, supremacy, and superiority. Because authors often use these terms to mean different things, it can be confusing when comparing multiple works. “Sea control,” “command of the sea,” “maritime superiority,” and “control of sea communications” are all similar concepts, but there is no generally accepted hierarchy or understanding of how each term relates to the others. Accordingly, in this project I use the single term of cyberspace superiority, while acknowledging that there will be different levels of cyberspace superiority from near parity among the combatants, to complete domination of all of cyberspace by one combatant. In many of the quotations from other authors throughout this project, they use other terms such as “command of the air” or “sea superiority” and I have not altered them. I consider each of them to refer to domain superiority in their domain, with the addition that sometimes they imply greater or lesser domain superiority, as in AFDD 3–12, which places cyberspace supremacy over cyberspace superiority. The range of strength of superiority that a combatant can achieve brings up the related question of how much superiority a combatant needs or should seek.

A combatant should be seeking just enough cyberspace superiority to achieve their objectives, because seeking too much superiority can be counterproductive and prevent the attainment of strategic or operational objectives. For a combatant to pursue domain superiority requires resources that they could have applied to other important objectives. In addition, if a combatant seeks too high a level of superiority, there can be significantly diminishing returns for the increased resources put toward solving the problem. For example, in the air domain a combatant may be able to reduce an enemy Integrated Air Defense System (IADS) to 50% effectiveness a...

Table of contents

• Cover
• Half Title
• Title Page
• Copyright Page
• Table of Contents
• List of Figures
• List of Tables
• 1 Introduction
• 2 Elements of Domain Superiority from the Other Domains
• 3 Cyberspace Domain Characteristics
• 4 Local Cyberspace Superiority
• 5 Measuring Cyberspace Superiority
• 6 Cyberspace Superiority Case Studies
• 7 Conclusion
• Appendix A: Coding of Measurement Inputs
• Appendix B: Cyberspace Superiority Case Study Measurement
• Index