This book has hopefully been a journey to a deeper understanding of cyber warfare, what it actually means, and what the real technical and non-technical challenges would be faced in the process of carrying out warfighting actions in the cyber domain. Now that we know how it really works, I think it is worth exploring the question of, should it work?
The cyber domain and both Title 10– and Title 50–type activities within it are extremely powerful tools to add to a state’s defensive apparatus and offensive arsenal. It is my belief that these resources should primarily be utilized and strategized as the unconventional capability they represent. When there is not open conflict, the intelligence gathering and covert action capabilities made available through the cyber domain cannot be ignored. However, it is in my opinion that trying to force the cyber domain as a warfighting resource in open conflict and alongside conventional warfare is not necessarily responsible.
There certainly are potential scenarios for the effective use of cyber warfare, but its true strategic value will likely not be realized until commanders and decision makers and warfighters alike come to a sufficient understanding of how cyber affects warfare and how war works in the cyber domain. Even presented with all of the information in this book, there may be individuals who still want to fire cyber bullets at the enemy; for those individuals and for any of you who read this book but want a quicker way to convey to others why cyber warfare doesn’t work the way they think, I have a useful analogy you can make.
Biological Warfare
Let’s focus for a minute on a concept most people will readily agree with. Biological warfare is a terribly irresponsible and ineffective way to wage war. National and international laws forbid its use. The Geneva Convention and other international bodies and agreements disparage it, and even before the world wised up and agreed to stand against biological warfare, it was extremely ineffective. Let’s take some time to cover why this is.
Communicability
Biological agents are dangerous because they can spread from individual to individual making a small deployment have effects against a large target set. Unfortunately, biological agents don’t necessarily spread with any reliability. This means that a commander could launch a biological attack with a target in mind, but that deployment of biological agents may not end up spreading to anywhere near the number of targets necessary to achieve the strategic goal of deploying it.
Effectiveness
Even if successfully deployed and spreading to 100% of the intended target set, biological agents do not have a guaranteed mortality rate of 100%. So, even if all enemy combatants are infected with a biological agent, there is going to be some percentage of them that make it through the infection and are still able to fight. There is also the fact that biological agents affect people at different speeds, so even if say 60% of those infected ended up dying, they may not be dead for weeks and that presents an undeterminable timetable for biological weapons. This means that if a commander were to use biological agents, they would have to plan their strategies around the fact that when they deploy a biological weapon against a target, there is no way of knowing how effective it will ultimately be.
Targetability
Probably the scariest aspect of biological warfare is the inability to guarantee with any kind of certainty that a biological agent will only affect those it was intended to target. Biological weapons may be launched against an enemy troop garrison, but a change in wind direction could blow the biological agent to a nearby town. Environmental changes aside, the fact that biological agents are indiscriminately communicable means that as troops take time off, visit their families, or are otherwise around non-combatants, including medical and supply staff, they can be spreading the weaponized agent to those non-combatants.
No Battle Damage Assessment
Given that once launched, a biological agent will take an unknown amount of time to spread to an unknown amount of targets who will themselves feel the effects of that agent at an unknown rate, and incubation time means commanders have almost no way of knowing how effective use of a biological agent may have been. Further, conducting battle damage assessment is unsafe. This is both because of the agent itself and because of the fact that there is no way of knowing if it successfully achieved the strategic goal of neutralizing enemy forces. If it was less effective than expected or had a longer incubation period against the targets than thought, they would potentially still be there ready to fight.
Control
Morality and ethical issues aside, the potential for a biological agent to quickly spread out of control means a single deployment could be devastating far beyond the commander’s intent. What if a biological agent, instead of taking longer to spread or have noticeable results, was on the other end of the spectrum? What if the agent spread far more effectively than was expected, infecting innocents and non-combatants and enemy troops alike? What if it became a pandemic and ended up causing devastating losses indiscriminately across the globe? The problem is there is no way to have a biological agent with an effective off switch.
Ownership
Ignoring the moral dilemmas and the lack of control or targetability and other strategic and tactical issues with biological warfare there is the aspect of ownership which makes it an ineffective weapon. Once a biological agent is deployed, the enemy can begin analyzing it as can third parties. There is a distinct possibility the enemy can take the biological agent and make it more effective, turning it back on the perpetrating state. There is also the potential that upon using the biological agent once, the enemy and other third parties are able to create a vaccine for it. Therefore, all the dangerous work that went into creating the weapon could be undone after one deployment making it a potentially target and use specific resource which is not ideal for warfighting. Further, through natural medical research efforts, strains similar to the biological agent may be found and vaccines created even while the biological weapon was waiting on the shelf to be used. There are also many mitigating capabilities to such weapons such as gas masks and other protective gear made for toxic environments.
Bringing It Together
I am in no way suggesting that cyber warfare should be internationally disavowed and never utilized because it is like biological warfare. The issues of cruelty and inhumane pain and suffering that come with biological agents have more to do with it being banned than do its tactical and strategic shortcomings. Now, if you were to ask someone strategically why using biological warfare as part of a greater conflict wouldn’t make sense and you followed up with some of the reasons just discussed, you would probably get nods of agreement. These biological warfare-related reasons are very similar to some of the reasons why large-scale warfare within the cyber domain won’t work as an effective tactical or strategic resource.
In open conflict the communications paths needed to carry out cyber warfighting are susceptible to interruption just as communicability in the use of biological agents cannot guarantee it spreads to the intended targets. Cyber exploits or attack effects and biological agents suffer from the same issues with effectiveness where there is no guarantee that the target needing a desired end effect will be vulnerable to the facilitating mechanism. Target troops can be resistant or less affected by biological agents than anticipated, and cyber targets may be invulnerable to the cyber resources in the perpetrating state’s arsenal.
Though to a lesser extent than biological warfare, cyber tools, especially those that rely on self-propagation such as worms, create targetability concerns. Both types of warfare have infectious weapons which cannot guarantee with adequate certainty that they will not spread to non-combatants and third parties not involved in conflict. Both also have the same volatile attributes that mean assessing their effectiveness post deployment can be next to impossible.
There is also the risks to ownership both types of warfare share. Huge investments are involved in developing weaponized cyber exploits and attack effects as well as biological agents. Ignoring the moral dilemma of using biological weapons, there is a serious concern for the cost-benefit of using it in formal widespread warfare just as there is with cyber tools. These resources risk becoming understood, copied, and reapplied by enemies and third parties alike. Further, there are the risks that those resources become nullified by natural developments of the medical or cyber security industries.
Summary
In this chapter we discussed biological warfare and without consideration for its ethical failings, that it falls short of a strategically deployable and tactically dependable weapon and form of warfare. This more widely understood concept was used as an analogy to more easily explain some of the reasons cyber warfare does not factually work as a standard domain of warfare as it is often misunderstood to be. The analogy is not perfect but hopefully leads to a more tempered understanding and approaches to deploying cyber warfighting resources in congruence with conventional conflicts.