It looks like the Department of Defense (DOD) is going to create a cyber warfare command that may have a war fighting capacity. There are issues with creating a single command structure, there are issues with the military trying to wage war in cyber space, there are issues with the political and legal systems involving Title 10, and there are of course training issues. Creating a command around cyber space could be one of the silliest or most brilliant ideas in a long time. When you add in the absolute risk to civil rights and current protections it is something that should be discussed.
If we were talking about this 20 years ago very few people would have understood what is at stake having a military component working in cyber space. Today the number is much higher on who understands, but what it means is still simply not accessible to most people. There are lots of discussions about cyber warfare that simply over state or mislead the public. So our first task is to identify cyber warfare.
Cyber warfare is conflict in cyber space for political purpose. If we invoke Clausewitz it is politics in action. If we consider cyber space to be the larger than the Internet environment of technology mediated communications of all types than that space is really big. The military types often refer to the global information grid as this huge space. Disrupting communications, spying on messages, disrupting or destroying the capability to communicate and using command and control through communications have always been part of war. Now we are talking about operating within that deep well of information flows and weaponizing that new terrain called cyber space.
There are many reasons to create a cyber command. First though consider the reasons against it. As a country regardless of tin-foil hat wearing individuals who love conspiracy theories we simply have not had a good record on respecting peoples rights. A default condition is that unless the right has been successfully defended in court that right does not exist even if it is part of the Constitution. From gun rights to freedom of speech and expression they are consistently shunted aside as political process. There is no reason to think an enlightened military branch won’t use peoples legal behaviors to their advantage when they can literally peer into the back of your mind as you surf the world wide web. A military or intelligence organization with the kind of access required will violate peoples rights and cloak those violations in national security. It isn’t a question it has been done before numerous times for other reasons.
A balance though of security and privacy is needed. Freedom is tricky when a dose of reality might let you stay alive to live another day. Most people when they talk about freedom of the press don’t really mean that. They don’t want to see nudes on the front page even if unfettered freedom of the press means exactly that. They want freedom that they can stand. Most people don’t really want companies to be free to do as they wish if it means acid rain and poisoned water. Freedom is responsibility and responsibility is a restriction on freedom. A cyber command most definitely means a restriction on freedoms.
Cyber command makes sense to the business analyst types. If you centralize resources, bring them all into one location, deliver those services out to customers in an as needed basis and control your supply of talent you are much more efficient. The problem is that model does not follow the Internet. Every router is provisioned to handle the maximum bandwidth all the time, every device is always plugged in and using electricity, there are links that cost $XXX a month to provision that are sometimes dry and not used and others for the same cost that are saturated to the point of failure. The global information grid is a lossful system and though it works just fine it is terribly inefficient. The battlespace as cyber space abhors tight controls and will route around restrictions through a variety of protocols. So the very basic building blocks of the terrain are against tight and standard management practices.
Another issue is separating the command structures into military and civilian commands to deal with the government systems including department of defense separate from the business and civilian systems. The national military infrastructure is layered across the civilian infrastructure. As any engineer can tell you that layering would suggest if the civilian infrastructure is disabled the military infrastructure on top of it will be disabled. I am sure there are protected networks but degradation in command and control can turn the tide of battle. It is a form of “smoke and haze” on the battlefield hiding enemy actions. So, separate commands or structures just create artificial structures that hamper or degrade the ability of this new service component from functioning.
Semper Cyber should be the motto of this new organization. Always governing, this would be the supreme effort. This organization would have to be able to direct and demand changes in the Internet. Most of those controls already exist in law but it would need to be transferred to them. The holistic evolving cyber command would need to be able to require certain safeguards be in place for business. For those who would cry foul a lot of requirements already exist for HIPPA, credit card companies, FERPA, and so many other types of privacy requirements. This new cyber organization would need to have similar regulative capacity as NERPC, and the FCC. With that one set of requirements a new element makes this discussion totally new.
Rather than the DOD plan a misguided method at wrangling budget dollars another plan makes much more legal, moral, ethical, and fiscal sense.
Cyber command should be a new department peer to DOD. The secretary of cyber operations would have the requirement of setting policy on training, regulation, and informing congress of issues and needs. A Department of Cyber Operations (DCO) would not be a large organization. Every cyber operator in government already in place would have a dotted line to DCO. You could not be a security specialist (defense) or security operator (offense) without DCO explicit permission. On the left side of the organization a civilian law enforcement and legislative assistance branch (for regulatory approvals), and on the right side military operations inclusive of intelligence community. The first challenge for the secretary of DCO would be to roll up the regulation and law packages into one cohesive book and trim them into a standardized regulation package.
A civilian head to the DCO would also alleviate many of the concerns of privacy advocates. A FISA style court system could be used as a stopgap to other concerns. One element that could help is for a primary goal of the DCO to increase privacy through aggressive regulation. As an example regulating data retention policies on data mining companies and protecting consumers would go a long way to facilitating acceptance. The current state of cyber is so woefully inadequate that doing anything might seem better than doing nothing. That would be an error and logical fallacy. The current regulatory practices allow and facilitate the Internet working. Significant legislative action could hamper or even destroy the Internet, as we know it. Legislators in the past have through error or political purpose destroyed entire industries. For examples ask yacht industry people about the luxury tax. For bigger industries let me walk you through steel country where legislation has destroyed a significant portion of Middle America.
To be honest I am not a fan of creating a cyber command. None of the current solutions will be much more than places to sink money. More importantly they are being pandered politically in ways that ignore the larger problem. Most of the discussion is around cyber security from a defensive angle. Offensive cyber warfare is often one of the last few things discussed and simply tacked on to the last paragraph in the last sentence so authors can say they discussed it.
1 thought on “Semper Cyber: A motto for a new military command”
Comments are closed.