Is Cyber a new warfare? Debate (catch all)

[selil]

I don't subscribe to "Daily Dave" I've got enough to chew on already. I looked at the presentation, but I don't know much about cyber warfare but for grins and giggles.

1. Cyberwar is asymmetric.
2. Cyberwar is non-kinetic.
3. Cyberwar is not attributable.

Of course cyber war is asymmetric. If you put "cyber" and "war" together than cyber is the modifier of war. War is inherently asymmetric otherwise it is a stalemate. That is as Clausewitz, Sun Tzu as you can get. Why would you engage in conflict it it was symmetric? That is why peer competitors rarely are aggressors towards each other.

The technical dimension or "cyber" expertise adds another dimension to the conflict spectrum of cyber. This technical dimension is also an element in the semantic layer of the cyber warfare domain. Of course that is if you take a multidimensional approach to cyber and don't try and smash it in with big war analogies and such. This also requires a spectrum approach rather than "silo" approach to cyber.

Cyber is kinetic. Stuxnet isn't only the proof, but dozens and dozens of other examples exist in the SCADA realm. Stuxnet is actually proof that "all ur air gaps belong to us". That is what is cool about Stuxnet.

As to attribution? Yes another fallacy. The best logic breaker on this one though is from other areas of forensics. How long does a full DNA screen take in a competent forensically sound manner? Weeks? At least days? How long does it take to do computer forensics on an attack? Weeks? At least day? But, the Internet is anonymous? <bs> It is only that way to a very few people, and you can detect those kinds of attacks too.

So. Three myths? I don't know if they are myths or just simple misunderstood. They may have had a bad childhood.

The point about the "OODA" loop is kind of out of left field. The OODA loop is nothing more than another explanatory model for the decision cycle. Decision sciences is filled with them, (SPA- search predict act; IPDE - identify, predict, decide, execute). The 1950s were rife with them as ways of managing risk or industrializing management processes. OODA isn't really anything special just something most military folks understand. So seeing "This isn't an OODA loop" has me fussy.

[Brett Patron]

Again, without a cogent definition of "cyber" this is a moot exercise.

I know...broken record....but just putting a word in front of another doesn't not necessarily modify.

[ganulv]

As a non-expert who can barely handle basic HTML I understand cyberwarfare to entail attacks upon networked resources via the use of networked resources (which is to say that blowing up a server room would not count as cyberwarfare).

[Erich G. Simmers]

Again, without a cogent definition of "cyber" this is a moot exercise.

I know...broken record....but just putting a word in front of another doesn't not necessarily modify.

Aitel's project here is getting towards that definition.

[Tukhachevskii]

What's the differance, if any, between "cyber"-warfare and old fashiooned Electronic Warfare? Isn't "cyber" warfare merely an extension of electronic warfare using an examded medium/technological base?

Sorry, don't really go in for neologisms unless they're absolutley necessary.

[Brett Patron]

What's the differance, if any, between "cyber"-warfare and old fashiooned Electronic Warfare? Isn't "cyber" warfare merely an extension of electronic warfare using an examded medium/technological base?

Sorry, don't really go in for neologisms unless they're absolutley necessary.

Up until cyberspace was declared a separate domain, the answer was "nothing". "Cyber" was covered under "Computer Network Operations" part of IO doctrine. The designation of this domain has truly disrupted many things; things that were really not thought through before such designation was made.

[motorfirebox]

What's the differance, if any, between "cyber"-warfare and old fashiooned Electronic Warfare? Isn't "cyber" warfare merely an extension of electronic warfare using an examded medium/technological base?

Sorry, don't really go in for neologisms unless they're absolutley necessary.

A case could be made for that, though I do think there are substantial differences between electronic warfare and what is generally referred to as cyberwarfare (currently, at least; the technologies will eventually grow together). Someone who is recognized as an electronic warfare specialist might very well be completely lost when it comes to defending against or conducting a cyberwarfare attack. There is a lot of overlap--encryption being the main shared set--but there's still a technology gap. E-war can be conducted with equipment half a century old, for one thing.

On the other hand, "cyberwar" is such a ridiculous gee-whiz term; I've always hated it.

[selil]

On the other hand, "cyberwar" is such a ridiculous gee-whiz term; I've always hated it.

Hate it or not it has been with us a long time. One of the issues I still see, as in this thread, is an attempt to restrict cyber to the network (whatever that is), and ignore the broader implications.

[Brett Patron]

Hate it or not it has been with us a long time. One of the issues I still see, as in this thread, is an attempt to restrict cyber to the network (whatever that is), and ignore the broader implications.

It's been with us because the zealots want to have it both ways..use "cyber" in a sentence and feel manly by saying "war"...

[Brett Patron]

Aitel's project here is getting towards that definition.

Until it's in JP 1-02 and explained via a stand alone Joint Pub (e.g. JP 3-12), it would be just another opinion, however well researched.

Right now, JP 1-02 does not even fully recognize cyberspace as a warfighting domain. I just looked at the just released JP 1-02..it ain't in there. However there is a term called "full spectrum superiority" that makes a pretty interesting distinction (emphasis added):

full-spectrum superiority — The cumulative effect of dominance in the air, land, maritime, and space domains and information environment that permits the conduct of joint operations without effective opposition or prohibitive interference.

[Brett Patron]

1. Cyberwar is asymmetric.
2. Cyberwar is non-kinetic.
3. Cyberwar is not attributable.

All "asymmetry" means is not taking on an adversary they way that adversary battles you. If you saw the movie "Tin Cup", the protagonist challenges an opponent to a golf round using only garden tools. Was it a "war"? Yes. Was asymmetry applied? Yes. The effects desired were achieved. It could easily be argued that the protagonist entered the contest at equal or greater skill. But rather than contest the ground (so to speak) with traditional "weapons" he used irregular ones.

Kinetic/non-kinetic; Lethal/Non-lethal are all going to blur as more things from which kinetics and lethality derive are computerized, have an IP address, or are controlled remotely using portions of the electromagnetic spectrum.

Attribution will come more from the will to say who than the ability to discover who. If a bunch of "religious extremists" plan, resource, and conduct their ops from a country (say, Outer Slabovia), there is usually no difficulty declaring that country a "state sponsor of terrorism". Yet if that same bunch were to conduct hacking and what not from IP addresses emanating from that same country, all manner of contortions are done to say it is "unattributed".

[Erich G. Simmers]

The point about the "OODA" loop is kind of out of left field. The OODA loop is nothing more than another explanatory model for the decision cycle. Decision sciences is filled with them, (SPA- search predict act; IPDE - identify, predict, decide, execute). The 1950s were rife with them as ways of managing risk or industrializing management processes. OODA isn't really anything special just something most military folks understand. So seeing "This isn't an OODA loop" has me fussy.

Yeah, I agree. I'd like to hear more on what he is getting at there.

Until it's in JP 1-02 and explained via a stand alone Joint Pub (e.g. JP 3-12), it would be just another opinion, however well researched.

Right now, JP 1-02 does not even fully recognize cyberspace as a warfighting domain. I just looked at the just released JP 1-02..it ain't in there. However there is a term called "full spectrum superiority" that makes a pretty interesting distinction (emphasis added):

Why wait for the definition to get reified in doctrine? It's not like doctrine will end the debate anyway; did FM3-24 put "COIN" as theory and practice to rest? My interest is in out-of-the-box thinking on that thing (some of which is new, some of which is old as dirt) that people call "cyberwar." DoD shouldn't be held up as the ultimate arbiter here, because frankly they may not have it right. It wouldn't be the first time, would it?

All "asymmetry" means is not taking on an adversary they way that adversary battles you. If you saw the movie "Tin Cup", the protagonist challenges an opponent to a golf round using only garden tools. Was it a "war"? Yes. Was asymmetry applied? Yes. The effects desired were achieved. It could easily be argued that the protagonist entered the contest at equal or greater skill. But rather than contest the ground (so to speak) with traditional "weapons" he used irregular ones.

I don't disagree with this characterization of asymmetry, but what really interests me is how Aitel characterizes cyberwar as less asymmetric then it is popularly conceived. He is challenging the notion that cyberwar, according to Rand and others, is "more asymmetric than most." Here's the quote from Cyberdeterrence and Cyberwar (PDF):

Perfectly symmetric warfare does not exist, particularly when the United States is involved. Yet cyberwarfare may be asymmetric than most. The U.S. economy and society are heavily networked; so is its military. The attacker, by contrast, may have no targets of consequence, either because it is not particularly digitized, because its digital assets are not networked to the outside world, or because such assets are not terribly important to its government.

I don't know if I agree with Aitel's view or Libicki's. Are you saying that both Aitel and Libicki have it wrong here? Are you saying something different entirely?

It seems like most people agree with #2 and #3 as being fallacies, but they don't agree with #1.

[Brett Patron]

Why wait for the definition to get reified in doctrine? It's not like doctrine will end the debate anyway; did FM3-24 put "COIN" as theory and practice to rest? My interest is in out-of-the-box thinking on that thing (some of which is new, some of which is old as dirt) that people call "cyberwar." DoD shouldn't be held up as the ultimate arbiter here, because frankly they may not have it right. It wouldn't be the first time, would it

You can't think "outside the box" if you don't know where the box is. You need doctrine if for no other reason than to have either a point of departure or something to ignore.

Also, for the less informed, without a doctrinal basis it is difficult to budget for capabilities.

We are held up/held hostage by the zealots who insist on cyberspace as a separate domain, rather than capabilities and/or a dimension within the existing physical domains. When you change verbs to nouns (i.e "conducting cyberspace ops/CNO" -verb to "cyberspace is a domain - noun), you need doctrine to justify budget line items. Nature of the beast folks.

That's why DOD is properly resourced and DHS/State are not so much so.

[Erich G. Simmers]

You can't think "outside the box" if you don't know where the box is. You need doctrine if for no other reason than to have either a point of departure or something to ignore.

Also, for the less informed, without a doctrinal basis it is difficult to budget for capabilities.

Within the limited purview of DoD, I don't disagree with either of these points. However, the larger conversation on this started long, long ago and isn't waiting for DoD to release some publication on it. My view is that we should get out in front with the non-DoD, non-government folks.

We are held up/held hostage by the zealots who insist on cyberspace as a separate domain, rather than capabilities and/or a dimension within the existing physical domains. When you change verbs to nouns (i.e "conducting cyberspace ops/CNO" -verb to "cyberspace is a domain - noun), you need doctrine to justify budget line items. Nature of the beast folks.

That's why DOD is properly resourced and DHS/State are not so much so.

I do agree that cyberspace as a separate domain, perhaps, misdirects the focus of what we are discussing. After all, when someone writes an exploit or takes advantage of some misconfiguration in a network to gain or deny access, they are attacking humans and human processe ultimately. The medium--a wireless network, an embedded device, whatever--is inconsequential.

Where I think the distinction is useful is in the cultural differences of practitioners. Plus, there has been a proliferation of new technologies (either in outright invention or creation of 'mash-ups') that are worth flagging with a new term.

It's been with us because the zealots want to have it both ways..use "cyber" in a sentence and feel manly by saying "war"...

Who in this thread is handing out valor awards to "cyberwarriors"? You're setting up a silly strawman here.

[DaveAitel]

This is probably the most interesting "fallacy" of cyberwar - if for no other reason than because it is the most counter-intuitive.

You get hilarity such as the following: From the CNAS report http://www.cnas.org/node/6405) volume 1 page 30:

In addition to a favorable cost ratio, attackers also possess advantages in the required levels of effort and complexity. According to the Defense Advanced Research Project Agency (DARPA), the number of lines of code included in security software increased from several thousand 20 years ago to nearly 10 million today. Over the same period, the number of lines of code included in malware remained constant at approximately 125. In other words, cyber defenses have grown exponentially in effort and complexity, but they continue to be defeated by offenses that require far less investment by the attacker.

These are things that can't possibly be true, of course, but they sound good when said to Congress!

People look at LulzSec and see an asymmetric operation - but small hacker groups are essentially resource peers with the organizations they take on (imho).

-dave

Referring to an earlier post:

I don't disagree with this characterization of asymmetry, but what really interests me is how Aitel characterizes cyberwar as less asymmetric then it is popularly conceived. He is challenging the notion that cyberwar, according to Rand and others, is "more asymmetric than most.

Here's the quote from Cyberdeterrence and Cyberwar (PDF):

I don't know if I agree with Aitel's view or Libicki's. Are you saying that both Aitel and Libicki have it wrong here? Are you saying something different entirely?

It seems like most people agree with #2 and #3 as being fallacies, but they don't agree with #1.

[Erich G. Simmers]

Of course cyber war is asymmetric. If you put "cyber" and "war" together than cyber is the modifier of war. War is inherently asymmetric otherwise it is a stalemate. That is as Clausewitz, Sun Tzu as you can get. Why would you engage in conflict it it was symmetric? That is why peer competitors rarely are aggressors towards each other.

Still processing the other bits of your post, but from what I gathered, Aitel is arguing that attacking or gaining access to computers is wrongly considered to be "asymmetric" in the same way, say, a ASBM being launched against a carrier is--that is, a "cheap" system of tactics/weapons used against an "expensive" system. Instead, there are these massively expensive parts of the cyberwar picture that are getting overlooked in "maintenance" and "analysis."

[motorfirebox]

Of course cyber war is asymmetric. If you put "cyber" and "war" together than cyber is the modifier of war. War is inherently asymmetric otherwise it is a stalemate. That is as Clausewitz, Sun Tzu as you can get. Why would you engage in conflict it it was symmetric? That is why peer competitors rarely are aggressors towards each other.

You're taking it a little too broadly. Yes, any conflict can, in some form, be described as "asymmetric", but given that, it's a simple matter and common practice to select for conflicts which are more extreme in their asymmetry. Your statement is comparable to saying that it's pointless to describe any person as "tall", because all people are taller than ants. Within the range of asymmetry that can be seen in warfare, some types of warfare are more asymmetric than others, and those are the ones we call "asymmetric warfare".

As a non-expert who can barely handle basic HTML I understand cyberwarfare to entail attacks upon networked resources via the use of networked resources (which is to say that blowing up a server room would not count as cyberwarfare).

I'm not the one to ask for a precise definition, but I'd say blowing up a server room could count as cyberwarfare. It depends on why you did it. If you blow up the room to kill the guy in it, maybe it's not really cyberwarfare; if you did it to take down the network the room serves, maybe it is. If you blow up the room to kill the IT techs who are preventing you from infiltrating your target network... maybe that counts too. I'm not sure it's actually all that necessary to strictly define what cyberwarfare means; as the practice grows, it will be integrated more completely into other forms of warfare (and other forms of warfare will be integrated into it).

[ganulv]

I'm not the one to ask for a precise definition, but I'd say blowing up a server room could count as cyberwarfare. It depends on why you did it. If you blow up the room to kill the guy in it, maybe it's not really cyberwarfare; if you did it to take down the network the room serves, maybe it is. If you blow up the room to kill the IT techs who are preventing you from infiltrating your target network... maybe that counts too. I'm not sure it's actually all that necessary to strictly define what cyberwarfare means; as the practice grows, it will be integrated more completely into other forms of warfare (and other forms of warfare will be integrated into it).

Is a commando sent to raid an airfield sent to do aerial warfare? Does it matter if a jump and/or forward air control is involved? However someone might answer those questions—and it would not surprise me if a body of literature debating such questions exists as I have seen much critical ink spilled in academia over less interesting questions—the fact would remain that without a thing called aerial warfare there would be no such thing as a raid on an airfield.

[Brett Patron]

Is a commando sent to raid an airfield sent to do aerial warfare? Does it matter if a jump and/or forward air control is involved? However someone might answer those questions—and it would not surprise me if a body of literature debating such questions exists as I have seen much critical ink spilled in academia over less interesting questions—the fact would remain that without a thing called aerial warfare there would be no such thing as a raid on an airfield.

Lets bear in mind...although there is an "air domain" both the maritime and land domains do claim a portion of the air above them for their operations as well. Further, there is almost always "inter-domain" operations, especially once you are considering actions beyond the most tactical level. So the example above does not really track with the question at hand.

(On a humorous side note: an AF Space officer, when asked where the air domain ends and space domain begins, replied, "when your air-breathing engine stops working, you're in space".

[ganulv]

Lets bear in mind...although there is an "air domain" both the maritime and land domains do claim a portion of the air above them for their operations as well. Further, there is almost always "inter-domain" operations, especially once you are considering actions beyond the most tactical level. So the example above does not really track with the question at hand.

(On a humorous side note: an AF Space officer, when asked where the air domain ends and space domain begins, replied, "when your air-breathing engine stops working, you're in space".

It strikes me that maritime, air, and space domains all have a location attribute—they can be identified using a Cartesian coordinate system. One useful question might be, “Is cyberspace not a domain because it lacks a location attribute or is cyberspace unique as a domain in its lack of location attribute?”*

*The infrastructure necessary for the existence of cyberspace can of course be put on a grid but the space in cyberspace is just a metaphor, and a not very felicitous metaphor as far as I am concerned.