Monday, February 27, 2012

Strategic Cyber War

Here is a very interesting and brief post discussing the state of debate concerning the evolution of the interface of information technology with warfare.

Informed with historical comparisons, the article invites one to consider the possibilities. One of the more worked over comparisons is based upon the decision to treat the cyber realm as a ‘domain’ of military activity, on par with the air land and sea domains. When one thinks about it in this way, one considers the possibilities vis use of offensive means in one domain to support actions in others. Case in point, how might one compare strategic bombing campaigns of times past with similar strategic campaigns carried out via the cyber domain? Consider this snippet from the post:

‘I have been bemused by the high level of attention given to this
second mode of "strategic cyberwar." Engaging in disruptive cyberattacks alone
is hardly a way to win wars. Think about aerial bombing again: Societies have
been standing up to it for the better part of a century, and almost all such
campaigns have failed. Civilian populations are just as likely, perhaps even
more so, to withstand assaults by bits and bytes. If highly destructive bombing
hasn't been able to break the human will, disruptive computer pinging surely

I wonder whether this assessment is accurate. The premise material does not support the conclusion, as stated. For, within the paragraph, we have premise material (ALMOST ALL such campaigns have failed’) that does not logically support the conclusion (‘computer pinging SURELY won’t break the will to fight’).

It seems to me that the extent to which a society would be able to withstand such attacks without being tempted to capitulate will depend on several factors. In short, the level of novelty of the attack, severity of its consequences, the perceived ease of cost and delivery for the attacker, as well as perceived immunity to counter-measures, all seem likely to increase the probability of success in using strategic cyber warfare against civilian infrastructure in effort to cause an enemy to lose the will to fight. Let me illustrate with the historical analogy that Arquilla presents.

Firstly, as noted in the paragraph, strategic bombing campaigns have typically failed, but not always. When, one may ask, have they succeeded?

Not necessarily when they were maximally destructive. Arquilla is right about this. Consider the strategic bombing campaigns during WWII, in Europe and Japan. They were near maximally destructive, particularly in the case of the fire-bombings of Tokyo and other major Japanese cities. Yet, it was not until the use of the two atomic bombs that the Japanese Emperor risked a coup in order to surrender. What changed with the atomic bombs? Were the Japanese going to surrender anyway? Evidence suggests not. The German leadership was similarly unmoved for years. The Germans did not surrender because they were being carpet bombed. Indeed, later in the war, they did not surrender because the allied armies were enclosing them. They surrendered because Hitler killed himself. Being the supreme leader, he was the one person that did not recognize the hopelessness of the situation. Once removed, those that did recognize this capitulated.

This sense of hopelessness was what was different in the two cases. I would suggest that it was not merely maximal destruction that brought the Japanese civilian leadership to this hopelessness, but the swift and concentrated delivery of that death, twice, with unprecedented and apparent ease. This had sufficient psychological impact. It led the Emperor to the inescapable conclusion that the situation was hopeless.

Crucial in the creation of the hopelessness was the crafting of an impression of willingness and ability to deliver such blows. There was a concerted strategic information operation that accompanied the bombing campaign in Japan. Foreboding, yet non-specific warnings were given of impending bombings, up to and including the two atomic bombs. Leaflets were dropped by the millions on all major cities, informing the populations of the true state of affairs vis their military’s conflict with civilian leadership, (informati0n our intelligence services were able to glean from extensive monitoring of Japanese communications). Leaflets were dropped suggesting evacuation, giving instructions for surrender, countering Japanese propaganda concerning allied forces’ treatment of surrendering forces or civilians. Not only that, our OWI was able to circumvent the Japanese media itself, and get the word out that the Emperor was willing to give up the war effort, in a very real way, forcing the Japanese military leadership to acquiesce, even before official word was circulated. Make no mistake about it; the will to fight was broken. It was brought about by a combination of the horrible novelty of the weapons, and a concerted information campaign, this married to a crafted perception or worry, at any rate that the Americans could continue in this course with relative ease and little cost. We brought about a sense of utter hopelessness.

This leads to a question engaged by the paragraph quoted. Is there any way a cyber attack on civilian infrastructure could similarly break the will of a country? It does not seem out of the realm of possibility (certainly logical possibility). Yet, one has to admit; much of the ‘shock and awe’ we saw in WWII would not be attainable. There would be no rubble, no bombs, no firestorms, and no deaths caused by these. However, to the extent that a cyber attack could cripple a nation’s financial infrastructure, and its ability to provide the necessities of life, one can imagine a non-kinetic analog of the ‘shock and awe’ experienced by the Hirohito and his civilian leadership, wherein the people of that nation would find themselves in a torpor similar to that of the besieged cities of Japan or Germany. If this has an effect on the leadership, the end could be met. While there would be no rubble, there would be devastation of a sort, apathy, and hopelessness, if conditions were right. What conditions?

The article notes similar if smaller scale successes in such attacks by the Russians in Georgia, 2008. In that case, attacks focused on Georgian command and control. One can easily imagine a wider, less discriminate use of cyber power, something analogous to strategic bombing during WWII. Indeed, Arquilla says as much:

In some respects, the Russo-Georgian conflict illuminates the potential of cyberwar in a manner not unlike the way the Spanish Civil War foreshadowed the rising dominance of air power 75 years ago, offering a preview of World War II's deadly aerial bombings. Like air warfare, cyberwar will only become more destructive over time. For that reason, the Pentagon was right last year to formally designate cyberspace as a "warfighting domain."

So, if a nation were to come under an extensive and wide ranging cyber attack, one that crippled its financial (and other) infrastructure, AND if recovery appeared hopeless unless it were to capitulate, one can imagine public pressure and realism could force the leadership to acquiesce. Imagine a society subject to this crippling effect for months or years, accompanied by an effective information operation designed to drive home the hopelessness of its situation. Does it seem out of the question in that case that the society would submit? (This makes no claims as to the plausibility of such strategic cyber attacks, but it is disquieting that those much more well informed than I, do worry about the possibility).

In fact, we can again move back to the realm of history for an example of such a campaign. I would suggest General Sherman’s march through the South had the earmarks of such a strategy. His army destroyed infrastructure, his bummers confiscated food and animals. The pressure he exerted caused the Confederate forces to do similar things, not only in hopes of forestalling the Union advance, but in order to feed and clothe themselves as they strategically withdrew from his path. Sherman disseminated information as to his intentions and knew Southern propaganda was generated as to his wantonness, destructiveness and numbers. He made sure freed slaves were informed that they would never again be subject to their masters. He removed them from their former places (some intentionally recruited, others not, but following his army nonetheless). He gave every appearance of being unstoppable. Despair and hopelessness followed in his wake. Yes, anger and resentment as well. But, as he would say on numerous occasions, he would make resistance so costly, so miserable that the southern states would never think to try rebellion again. As it turned out, he was right about that, even if he sewed seeds of decades of resentment.

It is not impossible that, just as Arquilla sees precursors of WWII strategic bombing campaigns in the beginnings of the use of air power in the Spanish civil war, so too, we could say along with him, that the use that the Russians have made of the cyber domain, in concert with conventional forces, foreshadows use of the same technology in broader ways. This becomes more tempting for powers, and indeed more likely, the further the technology is developed and refined. He is right to point out the various ways in which it is, as a matter of fact being developed. Will it develop to the point that an attack coming only in the cyber domain would be sufficient to bring a society to surrender, obviating the need for conventional forces? Time will tell.