Technology and tactics within the realm of cyber conflict are fairly well understood. Networks have been with us for a long time, and we have a fairly good grasp on the exploitation of vulnerabilities. Yet there is an unhealthy focus on network-centric forms of cyber conflict. If we consider cyber as a domain there should be metaphorically speaking multiple methods and strategies for operating within and dealing with the environment of cyber. The continued focus on one element of the cyber domain is like the horse cavalry ignoring mobile armor.
Another element of the cyber domain that we could consider is the strategy and leadership piece. What does cyber strategy look like? We have several documents that lay out high level strategy but we haven’t really defined the policy mechanisms beyond that. Then there is the temporal issues of cyber conflict. We have seen many discussion over the speed of conflict when unleashing particular forms of weaponry but there has been much less discussion about the decision cycle speed of the humans.
If you think that all cyber is network based (as in “The Internet”) consider the ramifications of that position. First, if true that means that all communication is part of the electromagnetic spectrum. This is a hairball of a point to make because depending on your point of view all matter is part of the electromagnetic spectrum. So we’re going to discuss these points at a slightly higher level. We have the plain old telephone system (POTS), we have the IP data network, and we have the wireless networks. Some of these items run over the fiber worldwide network. Given those elements being defined are they the only communication strategy in cyber space over the Internet? It might be better to realize that connectivity is required but be are less interested in the specific mechanism. As other techniques are adapted such as quantum networking, brain computer interfaces, and other non-internet communication strategies we will see a growing definition of cyber space. This discussion then hinges upon the much slower pace of definitions than the actual pace of technical implementation.
Cyber as a shadow of the other domains (click to make larger)
In some ways the infosphere replicates the earth based systems as a shadow world. Cyber is a domain separate from land, sea, air and space, and a shadow of all of them. Instead of drawing a Venn diagram of the four previous domains and adding a fifth element of cyber what we have is cyber as the “drop shadow” behind the Venn diagram. This allows us to better understand the transitional nature of cyber and how it reflects and integrates with the other domains. It is a domain, but it is unlike all of the other domains. As the other domains interact on each other cyber also acts upon the other domains.
This leads back to the concepts of strategy and operations (and easily tactics). We don’t refer to land or air domains through the use of analogy because we inherently understand them. Only in the case of cyber do we rely totally on the use of analogy and metaphor to explain operations. Analogy and metaphor are lossfull concepts where any fairly sophisticated metaphor will collapse under the weight of assumptions it stands upon. We don’t use bridge metaphors when driving ships, and we don’t talk about ballast when moving armor. The conceptual models being derived for cyber are holding it back and further eroding the operational and strategic impacts of understanding the domain.
The cyber domain needs new thinking that is inclusive of the entirety of the domain and not just looking at single features of the tools available. Strategic assessment of cyber is currently eroded by this lens and as such seams that are weakened allow for attacks against the interacting elements of the other domains. If you think of cyberspace using a poor space metaphor you can think of leaping between domains as a wormhole between cyberspace and the different realms. When we activate a cyber physical system we leap through the connectivity component of cyberspace to interact with an element in some other domain. This is in part what is really happening when a USAF drone crew is operating their drone over hostile terrain. Just because the use case seems mundane does not make it not so. In fact such simplistic examples explain a lot about how strategic posture and movement within the domain might be accomplished. Looking at the impacts of such a model and thinking of cyberspace as a domain set off on it’s own and not through reductionist terrestrial or sea based models allows for a much broader understanding of the threat envelope.
Since cyberspace is a domain we should find domain like actors, elements, and phenomenon within the domain. We should see weather, natives and interlopers, commerce, and development. All of the elements found in the other domains should be found in cyberspace. Yet, we still continue to act as if it is just something new and shiny.
Strategy in cyberspace is going to be about achieving goals and creating actions to accomplish those goals. Understanding that the various domains link to the cyberspace domain yet can be transited instantly through cyberspace injects changes in how mass, and maneuver might be considered in cyberspace. These concepts are not foreign or missing they are just mildly changed as they can be found in some specific character within all of the domains.
Just some concepts to chew upon.