The establishment of the US Cyber Command in 2010 confirmed that cyberspace is a new domain of warfare. The computer is not only a target but also a weapon. Therefore, national security thinkers must find a way to incorporate cyberattacks and defense into military doctrine as soon as possible.
The world’s most influential military treatise is Sun Tzu’s Art of War. Its compelling and adaptive wisdom has survived myriad revolutions in technology and human conflict. And its tactics and strategies have been applied to other disciplines, including business, sports, and personal relationships. Future cybercommanders will also find Sun Tzu’s guidance beneficial. For example, on defense, he warns leaders never to rely on the good intentions of others or to count on best-case scenarios. This is sound advice in cyberspace, because computers are attacked from the moment they connect to the Internet.
Here’s a quote from the section “Variation in Tactics”:
The Art of War teaches us to rely not on the likelihood of the enemy’s not coming, but on our own readiness to receive him; not on the chance of his not attacking, but rather on the fact that we have made our position unassailable.
On offense, cyberattacks are likely to play a leading role in future wars, where the nature of the fight could be, above all, over IT infrastructure. A cyber-only war might even please Sun Tzu, who argued that the best leaders can attain victory before combat is necessary: "The best thing of all is to take the enemy’s country whole and intact… Supreme excellence consists in breaking the enemy’s resistance without fighting."
In theory, cyberwarfare might be a good thing for the world if it makes future conflicts shorter and costs fewer lives, which could facilitate economic recovery and post-war diplomacy.
However, it may be difficult to write military doctrine for many aspects of cyberconflict that are truly revolutionary. Here are no fewer than 10 to consider:
- The Internet is an artificial environment that can be shaped in part according to national security requirements.
- The blinding proliferation of technology and hacker tools makes it impossible to be familiar with all of them.
- The proximity of adversaries is determined by connectivity and bandwidth, not terrestrial geography.
- Software updates and network reconfigurations change cyberbattle space unpredictably and without warning.
- Contrary to our historical understanding of war, cyberconflict favors the attacker.
- Cyberattacks are flexible enough to be effective for propaganda, espionage, and the destruction of critical infrastructure.
- The difficulty of obtaining reliable cyberattack attribution lessens the credibility of deterrence, prosecution, and retaliation.
- The “quiet” nature of cyberconflict means a significant battle could take place with only the direct participants knowing about it.
- The dearth of expertise and evidence can make victory, defeat, and battle damage a highly subjective undertaking.
- There are few moral inhibitions to cyberattacks, because they relate primarily to the use and abuse of data and computer code. So far, there is little perceived human suffering.
The world’s top military thinkers, including Sun Tzu, can help modern organizations fill the holes
in their cyberdefenses, but it will take many years to incorporate all the revolutionary aspects of cyberconflict into military doctrine.
— Kenneth Geers, NCIS Cyber Subject Matter Expert