The world of academia like any of the communities we have discussed is far from a cohesive mixture of opinions. The balance of the academic world is split between the large research universities, the regional public or private universities, and the smaller professional military education schools. The political wrangling of the academic disciplines over whether education or training is the most important is a political football that is only beaten by the research and education biases. These biases and mission objectives of higher education institutions are important to understand the biases inherent when thinking about cyber warfare.
The least harm concept has been a leading institutional objective since the creation of the Federation of American Scientists after the release of nuclear weapons. This idea informs science through institutional review boards that insure people are not exposed or used in ways that will harm them. What is classified, as harm would be a matter of opinion beyond the scope of this article. However, what we can say is that since cyber is a pervasive and ubiquitous technology that permeates society any actions within the cyber realm can be expected to effect people. In some ways the kinetic capabilities of cyber warfare may be more insidious than nuclear weapons. The intelligence and reconnaissance capabilities of cyber tools are dual use and of interest to draconian governance. Is it any wonder that academics shun advanced cyber warfare research?
Research into active cyber attack is a hotly contested area of research. When meeting with my colleagues I see that the simple euphemism of hacking alludes to further deeper network centric attack strategies. In most cases the homily of “it is easy to destroy but harder to create”, is bandied about as a reason to turn away from active attack research. This bias clearly blinds the academician to the dual use of most technologies. The difference between the blacksmith hammer and the war hammer is the intention of use. The same is true of network reconnaissance tools and many of the penetration testing tools. Academics in applied fields struggle between the world of now and the bedrock science of their disciplines past.
As a technologist my science background is actually computer science. Computer science then is spread thinly between the electrical engineering field (hardware) and the mathematics field (algorithms). In the realm of cyber warfare most computer scientists study encryption and create software to layer security on top of other systems (think firewall software or audit tools). As an applied specialist I on the other hand look at the holistic system to be implemented. From the use of computer systems output to the input of computer systems and the cognitive processing. A computer scientist came up with the OSI 7 Layer model. A technologist adds two more layers to it. This is an example of the inherent bias between the different disciplines. In my research I look for the models and metaphors of cyber warfare to better understand the scope and reach in total. Other scientists fitting in among the biases of academia dig deeper into the minutiae to hide among the noise. This is not a criticism but is born out by the research accepted and published in the highest regarded journals. The only argument more vociferous would be the “quant” and “qual” argument in social sciences.
Education is so simple. A legislator can stand on a hill a thousand miles away and decree change and the University in a corn field somewhere far to the west will comply. To quote my formerly teenage step-daughter “NOT!!”
Education and training are systems just like anything else. If you change something in the system it has effects on other elements in the system. It can take time for those changes to percolate through. Contrary to popular opinion millennia’s and teenagers are not born knowing how to program computers or do binary math. They are great at using computes. Kind of like grandma uses an elevator they can push buttons. There is no suddenly inherent digiratti gene that has subsumed all the difficulties of learning. Everybody has to learn and getting students to advance in the science, technology, engineering, math fields is not suddenly easier. If anything the social media mavens and attention deficit disorders of non-disciplined thinking millennia’s has eroded much of classic expectations of education. To that profound legislator or military general I would say to remember that a change in a freshman’s education wouldn’t take effect for four years. You can’t simply change the expectations on a senior and have that transcend the previous three years. And, the highly specific requirements of training and certification are not the answer because they change almost as rapidly as they are printed. If I have a bias it is this; generalize, plan for adaption, classic thinking education, more math rather than less, creativity rather than rote, life long learning.
Intellectual capital is why we have the university in the first place. If you have no respect for intelligence and you operate as a concrete thinker you will never respect the university. As academics we fall into that same set of biases and mental traps when thinking about hierarchical agencies like the military. That bias is then translated to institutional policies and research agendas. The research funding system in America and the academic bias towards fundamental (read not applied) research and the creation of the National Science Foundation are examples of this bias in action. Though NSF is a great tool it has led in some ways to a marginalization of academic research. NSF funding through out its existence has not kept pace with economy or any other standard measure for comparison. Meanwhile the other defense research entity DARPA has moved from fundamental research into almost exclusively applied research and from the University to private/corporate research.
It is a primary disconnect created between the bias of academicians and the concrete thinking of politicians and decision makers that has created this situation. The reason we have Universities versus trade schools is that the nation with the smartest geeks usually wins the wars. The Nazi’s scared away a lot of their top talent (or killed) and that brainpower was then used against them. In cyber warfare the United States has created a situation where academic research is either so specialized that it is literally a generation from useable, or so productized it is inherently flawed from inception. Products don’t win wars the ideas do. A corollary example is that the most dangerous thing on the battlefield is not the M16, but the Marine carrying it.
The tarnished ivory tower is the bastion of intellect holding the terrain. The military mindset can find itself some of the intellectual capability from organizations within the professional military educations system. However, even that organization is more like the civilian education system than it is like the military. The cyber warfare threat and analysis capabilities of the professional research environments are still dwarfed by the civilian research institution of the University. Yet I would suggest the professional military education systems produce substantially more applied research than the traditional University systems. A simple test is to see how many fundamental papers come out of the different environments versus the number of researchers.
I would suggest from inside the ivory tower that the incentives and biases of the involved actors have created a situation where academics are held in low regard, biased to not do cyber warfare research, and credentialism force-feeds “fundamental” sciences research over applied research. Now, my academic readers are going to be incensed at what they perceive as a series of slams against their profession (regardless if it isn’t cyber warfare research they will likely construe malice on my part since I’m a bought by the man asset). Outside agencies with three letter acronyms (you all know who) are going to be furious to amused that I didn’t criticize far enough (after all I’m a bought and paid for academician). De facto evidence to both sides that I don’t respect either side and in fact can’t engage in meaningful dialog.
All that said there is a place for academia in the cyber warfare research and discussion narrative. That place rather than being legislated or restricted by false admonishments should be based on the ideas and reflection of the parties engaged. I have had a hard time getting grants based on a less than spectacular publication record. There are few if any academic journals that publish cyber warfare research (one of those academic biases making it to the real world). Many of the journals exist to discuss the information operations aspect of cyber warfare, which is only one face of the entirety of the area of research. It is a dangerous road if we let the practitioners define the research rather than attempting to reflect science into the research agenda. History is littered with examples of “this is how we do it” as social and cultural epitaphs. Then again that would be my bias to use science to inform policy.
1 comment for “Cyber warfare: The academic community”