Nonfiction cyberwar

Cyberwar sounds like the title of a William Gibson science fiction novel. But it could become a reality for the U.S. military, which is grappling with the doctrine, policy, strategy and training necessary to fight a cyberwar. That scenario is far beyond the military’s current network defense capabilities. The need has become apparent to many military leaders, however, especially after recent Chinese probes of the Defense Department’s Unclassified but Sensitive IP Router Network and coordinated attacks — possibly instigated by Russia — on Estonia’s data network infrastructure. “If you’re defending in cyber, you’re already too late,” Lani Kass, director of the Air Force’s Cyberspace Task Force, told the audience at an Air Force Association conference in September. Marine Gen. James Cartwright, former commander of the Strategic Command, told a House Armed Services Committee panel earlier this year that the same principles of warfare that apply to sea, air and land combat should also apply to cyberspace. That would include capabilities “enabling us to take the fight to our adversaries, when necessary, to deter actions detrimental to our interests,” he said. The term cyberspace presents challenges for military leaders who want to prepare for a cyberwar. Gibson is widely credited with inventing the term in the early 1980s to describe a virtual reality universe that he and other writers were concocting from the evolution of computer networks, such as the then-fledgling Internet. Cyberspace became the universal term people used to describe those networks after the Web began to flourish in the mid-1990s. Since then, cyberspace has become synonymous with the esoteric inner workings of the Web and other large computer networks, whose virtual reality is different from the physical reality of guns, aircraft, ships and tanks.Military officials readily agree that the science fiction version probably colors the way many warfighters think of cyberspace. The problem with the science fiction view is that it is not how the U.S. military defines cyberspace for warfighting purposes. The Na tional Military Strategy for Cyberspace Operations, published in 2006, defines cyberspace as “a domain characterized by the use of electronics and the electromagnetic spectrum to store, modify and exchange data via networked systems and associated physical infrastructures.” The job of Lt. Col. David Fahrenkrug, chief strategist for the 8th Air Force and the person responsible for the Air Force’s cyberspace concepts and strategies, is to try to explain cyberwar in the real world. “There is a lot of misunderstanding about what cyberspace is, and a lot of what we are engaged in now is educating people,” he said.“My job is trying to communicate it in ways that people can grasp.” Fahrenkrug has an urgent job because the Air Force formed a provisional Cyber Command in September and plans to establish a fully operational one in 2008. The Navy and Army also have their own cyberwar programs, but some observers say the Air Force’s decision to create the first command devoted to cyberwar operations makes it the service leader in developing military expertise for cyberwar. The Strategic Command, which also has a cyberwar program, revealed earlier this year that it was teaming with the National Security Agency to develop the ability to attack foreign adversaries’ networks. The military has been challenged to convince people that cyberspace is about more than computers and networks, said Daniel Kuehl, professor of information operations and assurance at the National Defense University’s Information Resources Management College. Cyberspace is also about how TV can be used to influence people and how elect onics and the electromagnetic spectrum can interact. “Just like in the real world, you have the airspace and aircraft that inhabit it and outer space and satellites,” Kuehl said. “So with cyberspace, you have the naturally occurring EM spectrum and the man-made electronics technologies that exploit it.” The understanding of that and other important perspectives about cyberspace is still developing, Kuehl said. Just as operations in other warfighting domains can support or be supported by one another, cyberwar can support or be supported by actions in other domains. “The understanding of that framework is growing in the military,” he said. Old techniques, such as signals jamming and expertise developed for information operations — the collection and integration of essential information while denying that information to an adversary — all qualify for inclusion in the new cyberspace domain. The challenge is understanding how that knowledge applies to cyberspace and how it can be used to write doctrine for cyberwar. Fahrenkrug said the term information operations was defined too broadly in the past. “It brought a lot of cats and dogs into the mix with no real understanding of their relationship to each other,” he said. “There was no understanding other than [that] information was involved.” Now the military has identified the new domain of cyberspace, and it requires an understanding of how those elements relate to one another through the electromagnetic spectrum, he said. Another requirement, particularly for offensive cyberwar, is knowing how to control the cyberdomain to enable offensive forces to do what they want to do, Fahrenkrug said. That is well understood in terms of the ability to operate and maneuver in real space, but the military needs the same capability in the cyberdomain. “We don’t know how to control the domain, how to use it when we want to use it and how to use it to counter adversaries,” Fahrenkrug said. A large part of his job involves understanding how to guarantee maneuverability in cyberspace. In addition to developing new doctrine and strategy, DOD must train people to fight in cyberspace. Like other aspects of preparing for cyberwar, training cyberwarriors presents a challenge to military leaders. Air Force Chief of Staff Gen. T. Michael Moseley last year redefined the service’s mission as being “to fly and fight in air, space and cyberspace.” The challenge will be to train specialized groups of cyberwarriors and educate all Air Force employees about the importance of cyberspace, said Robert Mills, assistant professor of electrical engineering at the Air Force Institute of Technology. “We’re trying to bring about a culture change so that people understand what it is to fly in both the air and in cyberspace,” Mills said. “If you ask 10 different people now what they think cyberspace is, you’d get 10 different answers. One of the first things we need to do is get people thinking along the same lines.” Once people are on the same page, however, “warfighting is warfighting,” Mills said. He thinks the military’s biggest challenge is finding people with a warrior spirit and certain natural abilities and aptitudes for fighting in the cyberdomain. “What those are, we haven’t fully determined yet.” Stephen Northcutt, president of the SANS Institute, said the military has yet to develop a broad training regimen for the new cyberdomain. Cyberwarrior groups exist at the U.S. Military Academy, in the Air Force and in the Navy, but they are small teams. “We can’t licate the training those people receive for the wider population,” Northcutt said, adding that the need for a more general kind of training is just beginning to be understood. Northcutt said such training probably should be similar to the exercises the military uses to prepare people for deployment to Iraq. In those exercises, known as Mohave Viper simulations, warfighters-in-training are placed in a fabricated Iraqi village with Arabic-speaking role players to experience for 30 days what life is like for those fighting an insurgency. The military might be tempted simply to run simulations in a virtual environment to save costs, but that wouldn’t be adequate training for cyberwar, Northcutt said. “Training with toy swords creates toy swordsmen.” White Wolf Security is a company that provides simulation training for cyberwar and specializes in merging cyber and physical combat to prepare warfighters for those operations. But gaining acceptance of that training approach is difficult, said Tim Rosenberg, White Wolf ’s chief executive officer. The generals who run the armed forces haven’t yet figured out how to fit cyberspace into their understanding of general warfare, he said. “With cyberwar, we are at the stage around where the advent of the repeating rifle was,” Rosenberg said. “The technology is stabilized, and a certain level of skill has been attained in using it, but people aren’t yet sure where it fits into the scheme of combat.” Jim Lewis, director of the technology and public policy program at the Center for Strategic and International Studies, said the military should be focused on developing doctrine and strategy for the cyberdomain and establishing ways to work with other air, sea and ground forces. But that is difficult to achieve with a budget of double-digit millions, he said. Cyberwar is flying too far below the radar to gain much notice, Lewis said. “In some ways, people need an actual conflict to see how these things work, and we’ve not had that yet.”