2008-05-18

Strategic warfare in cyberspace

The USAF is considering building its own botnet. This is a really dumb idea. Richard Bejtlich has a good blog post which discusses many of the obvious problems here, but there are other reasons not to do this; foremost, that the USAF would be ignoring the advice of one of its experts and pioneers in the subject of the strategic use of information warfare.

First, isn't this approach really nothing more than effective central management of computer resources? I think that is a great idea. If the USAF has to use a buzzword and a cool twist to convince base commanders to buy into the central management of all of their computers, then so be it.

However, if the true purpose is to build an offensive strategic capability, then I fear we're in trouble. For the remainder of this entry, I will quote liberally from Col. Gregory Rattray's (8th AF, retired) seminal book, Strategic Warfare in Cyberspace. The argument against such an approach can be made almost entirely from quotes from this text.

In focusing on offense, strategic warfare theorists generally have been influenced by a belief that new technologies will allow attackers to get through and attack key centers of gravity. These theorists assume that adversaries subjected to such attacks have significant vulnerabilities. Strategic warfare theories assume that offensive strikes will prove capable of inflicting sufficient punishment on civilian targets or enough damage on infrastructures supporting military operations to influence adversaries and thereby achieve coercive or deterrent objectives. (p. 98)

What adversary of the US exists which could be coerced by such a force? What national "center of gravity" exists in cyberspace outside of the US? To date, we're the only ones vulnerable to such an attack. And not only that, as we saw during the cold war with the Soviet Union, developing this capability will only encourage our adversaries to develop the same capability - which could be used far more effectively on us than vice versa. To wit:

Enabling Conditions for Waging Strategic Warfare
[...]
3. Prospects for effective retaliation and escalation are minimized. Actors initiating strategic warfare need to assess an opponent's likely reactions to a strategic attack and possible courses of action after an attack has been sustained. Such attackers must also assess, prior to initiating attacks, their own vulnerabilities to strategic attack and their adversary's capability to retaliate
. The efficacy of an actor's threat or use of attacks will depend on its vulnerability to retaliation both in kind and through other military and nonmilitary means. (p. 99-100, emphasis mine)

And even assuming that all of these preconditions are met - that the military invests significant resources in its defensive posture to an attack in kind - even then, the efficacy of this strategy is dubious at best:

The use of force is not simply a linear exercise in orchestrating one's own forces and unleashing them with certain effect against the enemy. Adversaries will attempt to anticipate each other's actions and minimize their detrimental effects. The likely course of an opponent's actions can only be guessed at, however, not determined with any certainty. As eloquently developed by Edward Luttwak, strategy is governed by an interactive logic rather than a linear logic. (p. 78)

Prior to 6 August 1945, the strategic bombing campaigns of World War II had opened up a new battlefield for conflict based on attrition. These campaigns were neither quick nor decisive. Those assessing the potential for waging strategic information warfare have so far paid little attention to the possibility that its actual use may well confront similar hurdles in terms of requirements for lengthy campaigns and lack of decisiveness.
(p. 84, emphasis mine)

Does anyone still think this is a good idea or wise investment of resources?

No comments: