Bottom line: Despite what its name suggests, “cyber warfare” is more like an intelligence contest than an act of war. As military leaders develop an approach to this emerging tactic, they should keep this distinction in mind.
There is a distinct difference between military contests and intelligence contests.
The former “is a test of physical power” and involves everything from weapons development and testing to military exercises. The goal of these contests is either deterrence or prevention. Meanwhile, cyber contests are efforts to collect and operationalize strategic information, either to undermine or sabotage an enemy. Cyber contests may play an important role in a larger military contest, but ultimately are not “directly related to military posturing or war.”
The current state of cyber warfare is a direct result of the post-Cold War security environment.
The collapse of the Soviet Union left the United States without a primary enemy, and thus without a primary target for intelligence collection. Counterterrorism efforts briefly provided a more unified intelligence mission, which was dashed when Al-Qaeda collapsed. The recent rise of China and Russia have led some to declare the return of “great power competition.”
Thus far, great power cyber contests have revolved around “collecting and protecting” information.
China’s main cyber efforts are focused on stealing foreign intellectual property, while Russia has focused on exploiting computer networks. The United States, meanwhile, “deliberately seeks to use cyberspace competition to gain strategic advantage, not to score a decisive victory.” Actual cyber sabotage has been rare, but has been thought to occur in Iran and North Korea.
Success in this arena will require new ways of thinking about cyber contests.
“Because it is not a test of overt military power, traditional strategic theories about force and war may not be our best guide.” For instance, since cyber warfare is almost entirely clandestine, and often tolerated as a substitute for war, traditional ideas of deterrence do not apply. The aforementioned tolerance also removes the coercive power of cyber attacks.
Going forward, successful cyber engagement will require being comfortable with ambiguity, new modes of analysis, and above all else, a willingness to view cyber war more as part of an intelligence contest, and less as a form of military engagement.
Read the full piece here.