Five Myths Of Cyberspace And Cyberpower

U.S. Air Force personnel are cyberwarriors who must be skilled at establishing satellite communications, especially during combat operations.

Confronting misconceptions paves the way for superiority in the third domain.

The U.S. Air Force is building a robust cyberwar capability as part of a revised mission that adds cyberspace to the service’s fighting domains of air and space. As part of this effort, the secretary of the Air Force and the chief of staff of the Air Force established a Cyberspace Task Force to help frame the service’s direction in this third domain. The task force is working to harness capabilities, take stock of gaps and vulnerabilities, and increase awareness about cyberspace.

For the United States to be a cyberpower and to achieve cybersuperiority, it not only must hold adversaries at risk in the cyberspace domain, but it also must ensure freedom of action for friendly forces, exploiting the resulting advantage for cross-domain dominance. As the Air Force strives to deliver dominant cyber options that will support these efforts, it must debunk several common myths that exacerbate the challenges it faces. Dispelling these myths also is important to raising awareness of the new Air Force Cyberspace Command’s mission to prepare warriors for the joint fight in cyberspace.

Often, a lack of understanding of capabilities and vision perpetuates these myths. Sometimes the myths represent rationalizations to justify misallocation of scarce resources, and sometimes they are red herrings promoting agendas and protecting assets.

Myth #1 Because the technical skills are the same, it is advantageous to give the intelligence collector or the information service provider dual responsibility as the cyberwarrior. This is a myth for two reasons. First, combining responsibilities is not effective when the tasks are potentially competing for priority and advocacy. In the case of the intelligence collector, the competition is the traditional one of intelligence gain/loss assessment, where the warfighter must decide whether the intelligence value of gaining information from a target is worth more than the value of destroying that target. In all operational scenarios, the final authority on intelligence gain/loss is the operational commander, who alone must accept the potential risks. However, if the authority also is the intelligence collector, the tendency will be to avoid any operations jeopardizing collection activities. This conflict will be exacerbated in a large organization. Even if the leader accepts the dual responsibility, the staff, who is devoted to collection, will continue to impede all other operations. The same holds true for the conflict between providing service and countering threats to the network. The emphasis always is placed on ensuring service availability while the threats often are dismissed because of a lack of tangible effects.

Second, possession of technical skills does not automatically equate to possession of warfighting skills. Just as an aeronautical engineer could not go straight from the laboratory bench to lead a four-ship formation flying over Baghdad, the computer science engineer would not be fully prepared for the cyberfight just because he or she understands networks. The traits required to be a warfighter go beyond the engineering skills obtained in school or the laboratory. Computer network exploitation experts might be excellent analysts and engineers who understand ways to defeat the adversary, but much more is involved such as integration with other operations, translation of effects to tasks, estimation of collateral damage, weaponization, standardization and assessment of combat and laws of armed conflict. Cyberattack is not a mouse click away from computer network exploitation. Characterizing it as such is dangerous and reduces the commander’s confidence that it will be done correctly. Cyberwarfare must be a primary task that includes training.

Myth #2 The domain is a virtual one characterized by the Internet. This label has proved costly to the U.S. Defense Department, as exemplified by Gen. Ronald Keys, USAF, commander of the Air Combat Command, who spoke about operations in Iraq and Afghanistan in a January report in Aviation Week and Space Technology. “We have to have more visibility of what’s going on and where. Right now we don’t. We didn’t anticipate there was going to be this level of jamming ... At the same time, we’ve got people trying to listen [to insurgent conversations], a lot of it on the same or overlapping frequencies,” the general says.

It will prove catastrophic for the United States if the Air Force does not quickly convey the understanding that the cyberspace domain goes well beyond the Internet and is anything but virtual. It is not a cognitive concept, although it transcends the other physical domains and often links them to perception.

Consider the maritime domain. The oceans covering the Earth provide the environment while fluid dynamics and other physics principles govern action in the domain. In the cyberspace domain, the electromagnetic spectrum is the maneuver space also governed by laws of physics. That domain is a physically manifested space with closed/wired segments as well as free-space segments. Just as the boundaries between air and space can be blurred, cyberspace can occur within the other physical domains. Cyberspace should be recognized as a physical domain, occurring any place where the electromagnetic spectrum and electronic systems interlink. If it is not, seams and access points could allow adversaries access, and as Gen. Keys notes, the Air Force risks fratricide as it tries to conduct operations in the domain.

Myth #3 The battle to achieve cybersuperiority in any conflict can be fought from one location having independent, full situational awareness. Cyberspace is an extremely dynamic domain. Critical vulnerabilities and centers of gravity can shift at the speed of light. Points of access into adversary systems can open and close in seconds. Although the United States is linked extensively through the Internetted portion of the domain, operations in this segment may be only a fraction of the fight to dominate cyberspace against many potential enemies.

Satellite communications dishes are part of the cyberdomain, which is a physically manifested space with closed/wired segments as well as free-space segments.

For example, much of the adversary’s use of cyberspace can be held at risk only by capabilities operating in the line of sight of radio networks and closed battlefield command networks, in the footprint of satellites, with human-enabled access or within the range of future, high-power energy wave devices. Capabilities must not only be expeditionary, but they also must be flexible and integrated with the rest of the operational fight. The necessary level of situational awareness cannot be achieved independent of regional operations. Though a cyberwarfare commander may be able to command and control capabilities, creating effects globally from a single location, the command and control mechanism must be linked with other operations worldwide to achieve the necessary situational awareness.

There is one important caveat to this assessment: The global nature of the fight in cyberspace does require a central coordinating element to integrate international operations and ensure proper allocation of low-density, high-demand assets to tactical operations. Also, because of the insidious nature of many attacks in cyberspace and the adversary’s ability to conduct those attacks at many locations simultaneously, it is imperative to improve worldwide situational awareness and to be able to respond to those attacks globally via the most effective means.

Myth #4 Effects of cyberweapons are difficult to control. This is not nuclear warfare. The United States has been conducting cyberwarfare with cyberweapons for many decades. In fact, it has been conducting cyberwarfare with decidedly noncyberweapons—for example, a pair of scissors cutting telegraph lines—for much longer. Additionally, even with development of computer network attack capabilities, the targeting and collateral damage issues are no different than with effects created by explosive or kinetically destructive means.

All combat operations have potentially cascading effects. If a bomb drops on a hydroelectric power facility or destroys an electrical transformer yard, the impact can cascade to many different systems. In some instances, this is the exact intent of the attack. It also is possible to affect an activity that was not intended as a target. For example, telephone service to a hospital might be degraded by shutting down power to a military target or destroying a communications link serving the facility. In all instances, the potential unintended consequences must be considered for proportionality and other laws-of-armed-conflict considerations. The United States would never conduct a cyberattack without conducting exercises and developing the proper understanding of the effects so an informed operational decision could be made with the proper legal reviews. Cyberweapons will be used in the same professional manner and with the same operational rigor that the United States employs all conventional weapons.

Myth #5 Increasing security at every node will allow for effective defense of the domain. While it is imperative that security of networks and systems is improved, this effort will not ensure friendly freedom of maneuver. If the adversary is intent on conducting multipronged attacks throughout the domain, the domain will be overwhelmed quickly. Currently, substantial problems affect the United States’ ability to ensure that it does not inadvertently degrade or otherwise impact its own operations in the absence of concerted adversary attacks. It must begin to conduct real maneuver in the domain and be prepared to operate with degraded capabilities. A coordinated effort must occur across the entire joint team.

Considering the multitude of connections created by each military service operating in cyberspace, multiplied by several service or functional components, the possibility exists that a well-secured segment still can be rendered ineffective when a weaker link in the joint chain is attacked. The nation must be as prepared to counter an attack in cyberspace as it is in the other domains. For example, defending the airspace is not a job just for the Patriot batteries. The Air Force also must hunt down the adversaries’ offensive air and missile capabilities and destroy them. With this in mind, a robust ability to conduct maneuver and counter attacks in cyberspace may become an effective deterrent in and of itself.

Finally, it is important to realize that the Air Force would not necessarily counterattack on U.S. soil. Just as it would not bomb the flight school in Florida that trained the September 11, 2001, terrorists, it will take the fight to cyberattackers at a time and place of its choosing. Trying to respond on the same vector as that of the attack would be pointless. By the time the response occurred, the adversary already would have relocated to a different firing position in anticipation of the counterbattery fire.

Cyberspace is a complex domain where the Air Force recently has begun to acknowledge its leadership roles. While some academic debates are important to ensure rigor in the analysis, the Air Force must swiftly move itself forward to maintain leadership in the domain.

 “It will be an ongoing challenge for all of us to adapt and evolve in our understanding of cyberspace as the Air Force transforms to integrate and leverage cyberspace in concert with air and space; to achieve true cross-domain dominance; and to remain the premier Air Force in the world,” relates Col. Glenn Zimmermann, Kansas Air National Guard, in the February 8, 2007, issue of the Air University online journal, The Wright Stuff.

By addressing these five myths, the Air Force will improve understanding and ultimately its ability to achieve true cross-domain dominance.

Lt. Col. Forrest B. Hare, USAF, is the intelligence officer assigned to Headquarters U.S. Air Force Deputy Chief of Staff for Operations, Plans and Requirements and currently is detailed to the Air Force Cyberspace Task Force.

Web Resources
Cyberspace and InformationOperationsStudyCenter: www.au.af.mil/info-ops/usaf.htm
8th Air Force: www.8af.acc.af.mil