Equilibrium Networks

From a Wired blurb covering John Arquilla’s ideas about cyberdeterrence:

Armies (even guerrilla armies) are so dependent on digital communications these days that a well-placed network hit could hobble their forces. Do these cyberattacks right—and openly—and the belligerents will think twice before starting trouble. Arquilla calls his plan “a nonlethal way to deter lethal conflict.”

Sure, it’s risky. A misinterpreted or misattributed attack could inflame tensions. Or you might fritz the good guys and civilians by mistake. But Arquilla says this “kinder, gentler deterrence” is better than threatening to strangle an adversary’s economy or reduce its cities to radioactive cinders.

Over the past decade I have maintained the hope and at times even a tentative belief that cyberwar might be “kinder, gentler” war. I still hold that hope, but not the belief.

History and common sense have shown over time that militaries seek to make war more controllable for themselves and more chaotic for their opponents. But the nature of opponents has changed, and has typically broadened unless or until combatants are able or willing to sacrifice an advantage in raw killing power. The concept of total war has evolved with the Grande Armée, the March to the Sea, unrestricted submarine warfare in World War I, strategic bombing in World War II, and the nuclear hostage-taking of the Cold War. I suspect that the next total war will be organized around cyber. And make no mistake, the cyberwar will be unpleasant and sometimes lethal to noncombatants. But it will not be the only aspect of that war.

No military is going to forsake kinetic strikes for overt cyber strikes in the foreseeable future. Even assuming the effectiveness of a successful cyber strike, the reliability usually isn’t there. And if something is worth an overt strike without a reliable offensive cyber capability, then it’s worth a kinetic strike. Since there is no reason to believe that cyber can be anything but a complement to kinetic anytime soon, the idea of cyberdeterrence is meaningless without the more traditional forms of deterrence.

It’s worth noting that of the three scenarios mentioned in the Wired blurb, two are about the US interfering in a conflict between other states (India v. Pakistan and Russia v. Georgia) and one is about setting up honeypots for terrorists à la Dark Market. Nowhere does it mention an instance where the US is really a combatant. There’s a good reason for this: the US can deter other actors precisely because of its unparalleled strength. If the US launches an overt cyber strike, you can bet that it will be prepared to precipitate kinetic consequences and to get into a “real” fight.

Would we really attack India’s and Pakistan’s nuclear C2 in order to keep them from using nukes on each other? Not likely. It would be hard if not impossible to do effectively, might backfire in any number of ways, and the threat of US interference certainly wouldn’t deter them any more than nuclear war would.

Would we really deploy a “cyberdeterrent squad to disrupt the Russian military’s communication networks” over Georgia? Not likely. Georgia isn’t worth an essentially strategic strike against Russia in any event, especially if we couldn’t commit to a larger conflict that might emerge.

The “kinder, gentler deterrence” Arquilla talks about is little more than a proverbial shot over the bow. And it only works because of our real guns.