Actual cyber attacks intended to cause physical damage or destruction would still fall short of being decisive and wouldn't be able to produce victory by themselves during wartime, says James Andrew Lewis in a new essay.

Lewis, director of the Center for Strategic and International Studies' technology and public policy program, adds in a paper posted online Oct. 1 that cyber attacks are best perceived as simply another new technology applied to warfare.

War, even cyber war, is the use of force for political purposes by or against a state; without violence, there is no attack and without a threat of violence, there is no use of force, he adds. Not everything bad that occurs on the Internet is an attack. Surreptitious exploitation of cybersecurity holes without damage or destruction "is not intimidation, not the use of force, and not an attack," Lewis says.

Cyber attacks within the context of war can create friction that slows, distracts and maybe weakens an opponent's response, so they do have military advantage. But by themselves they will not be decisive, Lewis writes.

Were an enemy to attack the industrial infrastructure of its opponent, it's debatable whether doing so would bring the attacker much advantage. Such attacks likely won't produce tactical advantage in theater, and their political effects would be difficult to predict. Just as strategic bombing historically has strengthened opponents' will to resist, so too could sustained cyber attacks against homeland infrastructure.  

If an enemy could attack, through cyber means, an industrial chokepoint--a function without which the ability to supply forces would be lost--that could change, Lewis writes. However, particularly for large industrialized countries, such chokepoints might not exist. American strategists in World War II thought they could halt German military production in 1943 by destroying ball bearing factories in Schweinfurt, but Germany was able to adapt by dispersing production despite the loss of factories there.

An opponent such as Russia or China would probably avoid striking critical infrastructure within the U.S. homeland due to worries about escalating the conflict, Lewis writes. However, that could change should other factors arise that outweigh the dangers of escalation, such as popular discontent with the execution of a war. Other states, such as Iran or North Korea might not be bound at all by escalation fears or common notions of deterrence and so would feel little or no constraint against unleashing cyber weapons against the U.S. homeland in the event of American forces striking those countries, he adds.

 For more:
- download the essay (.pdf)

Related Articles:
Lynn: Cyber deterrence rests mostly on denial, not retaliation
Lewis: Cold War lessons of limited value for cyber attack deterrence
Lewis: U.S. not in a cyber war