There has always been a healthy debate about the nature — and even the existence — of “cyber war.” In 1993, Prof. John Arquilla published a pioneering essay called “Cyberwar is Coming,” which preceded many similar works from the next generation of academic and military thinkers. But not everyone was convinced. The largest hacker conference in world, DEF CON, abhors the notion, and some other professors, such as Prof. Thomas Rid, have countered with books such as Cyber War Will Not Take Place. Most people, including me, are somewhere in middle. For us, hacker movies such as War Games (1983) and Ghost in the Shell (1995) possess the unnerving quality of being not only great entertainment but also plausible science fiction.
Only time will tell. But recently, Planet Earth’s most powerful political and military alliance, NATO, placed its bet. In its July 2016 Warsaw Summit Communiqué, NATO declared that cyberattacks can be “as harmful to modern societies as a conventional attack.” Further, NATO decided to recognize cyberspace as a domain of warfare, where it must defend member states “as effectively as it does in the air, on land, and at sea.” Laugh if you will, but this announcement was surely informed by years of analysis and difficult decision-making.
For the past two years, I have lived in Kyiv and closely watched the evolution of Ukraine’s political and military contest with Russia, along with my students, from the relative safety of a beautiful university campus. So, in early 2015, when the NATO Cooperative Cyber Defense Centre of Excellence in Tallinn, Estonia, approached me about writing a book for their fast-growing Cyber Security Publication Library, I thought that the best contribution I could make from Kyiv would be to assemble a team of experts to evaluate whether the conflict in Crimea and Donbass has a significant cyber element, and if so, to what extent had cyberattacks been influential in deciding military outcomes. Our book contains 18 chapters, ranging from Glib Pakharenko’s “Cyber Operations at Maidan” to Martin Libicki’s “The Cyber War that Wasn’t.”
In theory, the conflict between Russia and Ukraine has all the necessary ingredients for “cyber war.” The two nations are playing for the highest geopolitical stakes, and both have expertise in information technology and computer hacking. But international war is not espionage, nor is it financial crime. Spies and criminals have made outstanding use of malicious code, but our research concerned soldiers and military affairs. And while the NSA is widely credited with facilitating the U.S. surge in Iraq in 2007, and Stuxnet may have helped forestall a real-world war between the West and Iran, at this point in history there are just not many examples of “cyber war” to analyze.
As editor of this NATO CCD COE book, I think there are two primary takeaways. First, cyberattacks are all around us; there were examples everywhere we looked: in the military, political, diplomatic, economic, critical infrastructure and social domains. Second, none of them was decisive, and cyberattacks are not likely to be decisive in any traditional geopolitical conflict; this latter insight should not be surprising, given that not even the U.S. military — despite its submarines and stealth fighters — can win a war that goes against the very grain of history.
And yet … national security planners cannot underestimate the potential for cyberattacks to win individual battles. If a tank commander suddenly discovers that an adversary has unleashed a “zero day” digital attack against an operating system or application within his or her rolling and shooting computer network, it may be a long day on the battlefield.
In the often-lampooned concept of “Cyber Pearl Harbor,” most critics forget that Admiral Yamamoto did not expect to win the Pacific War in Hawaii, but simply to gain an advantage in time and space before the inevitable counterattack. In modern war, cyberattacks will be used in precisely the same way. In other words, if you fear the ricochet, don’t fire. And this fact already provides a degree of cyberattack deterrence to major world powers.
On balance, cyber war still has more questions than answers. For example, what are the limits to nation-state hacking, especially in peacetime? You simply cannot own an adversary “hard target” such as a weapons platform or military command-and-control system when time is short. Once the fighting starts, it will be too late. Therefore, militaries will have an incredible temptation to hack the hell of everyone in peacetime, which will lead to what pipe-smoking international relations professors call the “security dilemma,” in which preparation for war becomes a self-fulfilling prophecy.
My Black Hat presentation, entitled Cyber War in Persective: Analysis from the Crisis in Ukraine, is a benchmark in the evolution of cyber war, meant for national security decision makers and system administrators alike. It is based on NATO Cyber Centre research written by 20 leading thinkers on national security and network security, and it helps to shed light on whether cyber war is now reality — or still science fiction.
