Study cyber weapons use at tactical level, urges CSIS paper


The potential for cyber weapons' tactical integration into military operations can't be known without systematic experimentation, says a Center for Strategic and International Studies report based on workshops with military and other experts.

The nature of cyber weapons has caused many cyber thinkers to conclude that there is no meaningful difference between their deployment at a strategic or tactical level. The interconnectedness of networks means that effects can't be meaningfully limited, "and therefore that any given cyber attack, no matter how discretely intentioned, could have massive unintended consequences and poses unknown but potentially significant political risk," the report says, describing that viewpoint.

Even if effects could be limited, the amount of time it would take to identify and defeat a target could be longer than what an operational or tactical commander could support, say those who lean toward the view of cyber weapons as a strategic tool. Tactical deployment of cyber weapons also brings up questions of deconfliction; a tactically attractive target might be best kept operational from a strategic perspective. Deployment of cyber weapons could result in their devaluation, since once utilized, the enemy could mitigate the vulnerabilities that make them possible--making cyber weapon use "a decision that only combatant commanders or national authorities are competent to make."

Should the United States decide to allow lower echelon commanders to deploy offensive cyber commands, knowledge of the weapons' capabilities would have to extend to a wider circle of people than the highly classified select few who now know of them, as well.

There are also questions about opportunity cost, whether investment in cyber weapons at a tactical level is the best use of shrinking resources.

But, "at this point the discussion about resources is largely premature." The Defense Department lacks understanding of how cyber weapons at lower levels would actually be used, whether they're technically feasible. Today's focus on strategic targets means there has been less attention devoted to addressing tactical targets; most agree that targets that would be most relevant in a tactical or operational context have been under-explored, the report says.

As for loss of cyber weapons' value to the intelligence community, which may prefer not to have the weapons' capabilities revealed, there already exist processes to evaluate the relative gain and loss ratios of tactically using intelligence resources. In addition, joint management of a cyber operational area could lead to deconfliction of strategic and tactical strikes, although establishing a cyber joint operational area would be particularly challenging "because traditional geographic boundaries are much less applicable."

The report makes two recommendations. The secretary of defense should affirmatively state that there are not lawful constraints on cyber weapons different from any other kind of weapon. And, the DoD should develop a plan for experimentation and exercises that explore operational and tactical cyber use, the report says.

As one workshop participant said, the report also says, "adversaries are at least to some degree already pursuing (and using) some of these capabilities."

For more:
- download the report, "Offensive Cyber Capabilities at the Operational Level; The Way Ahead" (.pdf)

Related Articles:
Benefits of brandishing cyber weapons not obvious, says Rand paper
U.S. wrongly prioritizes cyber offensive, says Rid
Threshold for kinetic response to cyber higher than for physical attack, says paper