Nonfiction cyberwar

Cyberwar sounds like the title of a William Gibson science fiction novel. But it could become a reality for the U.S. military, which is grappling with the doctrine, policy, strategy and training necessary to fight a cyberwar. That scenario is far beyond the military’s current network defense capabilities. The need has become apparent to many military leaders, however, especially after recent Chinese probes of the Defense Department’s Unclassified but Sensitive IP Router Network and coordinated attacks — possibly instigated by Russia — on Estonia’s data network infrastructure. “If you’re defending in cyber, you’re already too late,” Lani Kass, director of the Air Force’s Cyberspace Task Force, told the audience at an Air Force Association conference in September. Marine Gen. James Cartwright, former commander of the Strategic Command, told a House Armed Services Committee panel earlier this year that the same principles of warfare that apply to sea, air and land combat should also apply to cyberspace. That would include capabilities “enabling us to take the fight to our adversaries, when necessary, to deter actions detrimental to our interests,” he said. The term cyberspace presents challenges for military leaders who want to prepare for a cyberwar. Gibson is widely credited with inventing the term in the early 1980s to describe a virtual reality universe that he and other writers were concocting from the evolution of computer networks, such as the then-fledgling Internet. Cyberspace became the universal term people used to describe those networks after the Web began to flourish in the mid-1990s. Since then, cyberspace has become synonymous with the esoteric inner workings of the Web and other large computer networks, whose virtual reality is different from the physical reality of guns, aircraft, ships and tanks.Military officials readily agree that the science fiction version probably colors the way many warfighters think of cyberspace. The problem with the science fiction view is that it is not how the U.S. military defines cyberspace for warfighting purposes. The Na tional Military Strategy for Cyberspace Operations, published in 2006, defines cyberspace as “a domain characterized by the use of electronics and the electromagnetic spectrum to store, modify and exchange data via networked systems and associated physical infrastructures.” The job of Lt. Col. David Fahrenkrug, chief strategist for the 8th Air Force and the person responsible for the Air Force’s cyberspace concepts and strategies, is to try to explain cyberwar in the real world. “There is a lot of misunderstanding about what cyberspace is, and a lot of what we are engaged in now is educating people,” he said.“My job is trying to communicate it in ways that people can grasp.” Fahrenkrug has an urgent job because the Air Force formed a provisional Cyber Command in September and plans to establish a fully operational one in 2008. The Navy and Army also have their own cyberwar programs, but some observers say the Air Force’s decision to create the first command devoted to cyberwar operations makes it the service leader in developing military expertise for cyberwar. The Strategic Command, which also has a cyberwar program, revealed earlier this year that it was teaming with the National Security Agency to develop the ability to attack foreign adversaries’ networks. The military has been challenged to convince people that cyberspace is about more than computers and networks, said Daniel Kuehl, professor of information operations and assurance at the National Defense University’s Information Resources Management College. Cyberspace is also about how TV can be used to influence people and how elect onics and the electromagnetic spectrum can interact. “Just like in the real world, you have the airspace and aircraft that inhabit it and outer space and satellites,” Kuehl said. “So with cyberspace, you have the naturally occurring EM spectrum and the man-made electronics technologies that exploit it.” The understanding of that and other important perspectives about cyberspace is still developing, Kuehl said. Just as operations in other warfighting domains can support or be supported by one another, cyberwar can support or be supported by actions in other domains. “The understanding of that framework is growing in the military,” he said. Old techniques, such as signals jamming and expertise developed for information operations — the collection and integration of essential information while denying that information to an adversary — all qualify for inclusion in the new cyberspace domain. The challenge is understanding how that knowledge applies to cyberspace and how it can be used to write doctrine for cyberwar. Fahrenkrug said the term information operations was defined too broadly in the past. “It brought a lot of cats and dogs into the mix with no real understanding of their relationship to each other,” he said. “There was no understanding other than [that] information was involved.” Now the military has identified the new domain of cyberspace, and it requires an understanding of how those elements relate to one another through the electromagnetic spectrum, he said. Another requirement, particularly for offensive cyberwar, is knowing how to control the cyberdomain to enable offensive forces to do what they want to do, Fahrenkrug said. That is well understood in terms of the ability to operate and maneuver in real space, but the military needs the same capability in the cyberdomain. “We don’t know how to control the domain, how to use it when we want to use it and how to use it to counter adversaries,” Fahrenkrug said. A large part of his job involves understanding how to guarantee maneuverability in cyberspace. In addition to developing new doctrine and strategy, DOD must train people to fight in cyberspace. Like other aspects of preparing for cyberwar, training cyberwarriors presents a challenge to military leaders. Air Force Chief of Staff Gen. T. Michael Moseley last year redefined the service’s mission as being “to fly and fight in air, space and cyberspace.” The challenge will be to train specialized groups of cyberwarriors and educate all Air Force employees about the importance of cyberspace, said Robert Mills, assistant professor of electrical engineering at the Air Force Institute of Technology. “We’re trying to bring about a culture change so that people understand what it is to fly in both the air and in cyberspace,” Mills said. “If you ask 10 different people now what they think cyberspace is, you’d get 10 different answers. One of the first things we need to do is get people thinking along the same lines.” Once people are on the same page, however, “warfighting is warfighting,” Mills said. He thinks the military’s biggest challenge is finding people with a warrior spirit and certain natural abilities and aptitudes for fighting in the cyberdomain. “What those are, we haven’t fully determined yet.” Stephen Northcutt, president of the SANS Institute, said the military has yet to develop a broad training regimen for the new cyberdomain. Cyberwarrior groups exist at the U.S. Military Academy, in the Air Force and in the Navy, but they are small teams. “We can’t licate the training those people receive for the wider population,” Northcutt said, adding that the need for a more general kind of training is just beginning to be understood. Northcutt said such training probably should be similar to the exercises the military uses to prepare people for deployment to Iraq. In those exercises, known as Mohave Viper simulations, warfighters-in-training are placed in a fabricated Iraqi village with Arabic-speaking role players to experience for 30 days what life is like for those fighting an insurgency. The military might be tempted simply to run simulations in a virtual environment to save costs, but that wouldn’t be adequate training for cyberwar, Northcutt said. “Training with toy swords creates toy swordsmen.” White Wolf Security is a company that provides simulation training for cyberwar and specializes in merging cyber and physical combat to prepare warfighters for those operations. But gaining acceptance of that training approach is difficult, said Tim Rosenberg, White Wolf ’s chief executive officer. The generals who run the armed forces haven’t yet figured out how to fit cyberspace into their understanding of general warfare, he said. “With cyberwar, we are at the stage around where the advent of the repeating rifle was,” Rosenberg said. “The technology is stabilized, and a certain level of skill has been attained in using it, but people aren’t yet sure where it fits into the scheme of combat.” Jim Lewis, director of the technology and public policy program at the Center for Strategic and International Studies, said the military should be focused on developing doctrine and strategy for the cyberdomain and establishing ways to work with other air, sea and ground forces. But that is difficult to achieve with a budget of double-digit millions, he said. Cyberwar is flying too far below the radar to gain much notice, Lewis said. “In some ways, people need an actual conflict to see how these things work, and we’ve not had that yet.”

New career: Cyberwarrior

One way to assess how deep a cyberoperations mentality penetrates the military culture is to observe how the services handle recruitment and training through their designated career paths.

Each service has its own career-path designations. For the Army and Marine Corps, the term is Military Occupational Specialties. The Navy term is Enlisted Classifications.

The Air Force has Specialty Codes.

The Air Force is expected to change its Specialty Codes in the next few weeks to reflect new career fields for cyberoperations officers who will train to staff the new Air Force Cyber Command.

Unlike the pilots who fly physical aircraft, the pilots of cybercraft will not be chosen strictly from the officer corps. The Air Force will train enlisted men and women whom they deem to have the right aptitude to fight in cyberspace.

It is possible that at least a portion of the Air Force cyberforce will consist of reservists. Potentially, there could be a cyberunit provided in each state by the Air National Guard.

— Brian Robinson

Legal, ethical concerns

One aspect of combat in cyberspace that is vastly different from physical combat is the potential for widespread collateral damage, military researchers say. On the physical battlefield, collateral damage is limited to the vicinity of the attacks. In cyberspace, however, the global reach of the Internet means that the collateral damage from cyberattacks could be international in scope.

The unintended consequences of cyberwar are a major issue in debates about its ethics and legality, said Daniel Kuehl, professor of information operations and assurance at the National Defense University’s Information Resources Management College.

Many of those debates tend to be about economic concerns and how international markets might be affected by attacks on computer networks in other countries. But, in practice, economic interests tend not to be so prominent when a decision is made to go to war, Kuehl said.

Modeling capabilities similar to those used to assess the potential for collateral damage from ultrahigh-velocity weapons could help mitigate those concerns, he said.

But that kind of modeling capability doesn’t yet exist for cyberwar.

— Brian Robinson

























Understanding cyberspace














Controlling the domain
















Training challenges
















NEXT STORY: Measuring green

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.