Five Myths Of Cyberspace And Cyberpower

Signal, Jun 2007 by Hare, Forrest B

Confronting misconceptions paves the way for superiority in the third domain.

The U.S. Air Force is building a robust cyberwar capability as part of a revised mission that adds cyberspace to the service's fighting domains of air and space. As part of this effort, the secretary of the Air Force and the chief of staff of the Air Force established a Cyberspace Task Force to help frame the service's direction in this third domain. The task force is working to harness capabilities, take stock of gaps and vulnerabilities, and increase awareness about cyberspace.

For the United States to be a cyberpower and to achieve cybersuperiority, it not only must hold adversaries at risk in the cyberspace domain, but it also must ensure freedom of action for friendly forces, exploiting the resulting advantage for cross-domain dominance. As the Air Force strives to deliver dominant cyber options that will support these efforts, it must debunk several common myths that exacerbate the challenges it faces. Dispelling these myths also is important to raising awareness of the new Air Force Cyberspace Command's mission to prepare warriors for the joint fight in cyberspace.

Often, a lack of understanding of capabilities and vision perpetuates these myths. Sometimes the myths represent rationalizations to justify misallocation of scarce resources, and sometimes they are red herrings promoting agendas and protecting assets.

MYTH #1

Because the technical skills are the same, it is advantageous to give the intelligence collector or the information service provider dual responsibility as the cyberwarrior. This is a myth for two reasons. First, combining responsibilities is not effective when the tasks are potentially competing for priority and advocacy. In the case of the intelligence collector, the competition is the traditional one of intelligence gain/loss assessment, where the warfighter must decide whether the intelligence value of gaining information from a target is worth more than the value of destroying that target. In all operational scenarios, the final authority on intelligence gain/loss is the operational commander, who alone must accept the potential risks. However, if the authority also is the intelligence collector, the tendency will be to avoid any operations jeopardizing collection activities. This conflict will be exacerbated in a large organization. Even if the leader accepts the dual responsibility, the staff, who is devoted to collection, will continue to impede all other operations. The same holds true for the conflict between providing service and countering threats to the network. The emphasis always is placed on ensuring service availability while the threats often are dismissed because of a lack of tangible effects.

second, possession of technical skills does not automatically equate to possession of warfighting skills. Just as an aeronautical engineer could not go straight from the laboratory bench to lead a four-ship formation flying over Baghdad, the computer science engineer would not be fully prepared for the cyberfight just because he or she understands networks. The traits required to be a warfighter go beyond the engineering skills obtained in school or the laboratory. Computer network exploitation experts might be excellent analysts and engineers who understand ways to defeat the adversary, but much more is involved such as integration with other operations, translation of effects to tasks, estimation of collateral damage, weaponization, standardization and assessment of combat and laws of armed conflict. Cyberattack is not a mouse click away from computer network exploitation. Characterizing it as such is dangerous and reduces the commander's confidence that it will be done correctly. Cyberwarfare must be a primary task that includes training.

MYT #2

The domain is a virtual one characterized by the Internet. This label has proved costly to the U.S. Defense Department, as exemplified by Gen. Ronald Keys, USAF, commander of the Air Combat Command, who spoke about operations in Iraq and Afghanistan in a January report in Aviation Week and Space Technology. "We have to have more visibility of what's going on and where. Right now we don't. We didn't anticipate there was going to be this level of jamming ... At the same time, we've got people trying to listen [to insurgent conversations], a lot of it on the same or overlapping frequencies," the general says.

It will prove catastrophic for the United States if the Air Force does not quickly convey the understanding that the cyberspace domain goes well beyond the Internet and is anything but virtual. It is not a cognitive concept, although it transcends the other physical domains and often links them to perception.

Consider the maritime domain. The oceans covering the Earth provide the environment while fluid dynamics and other physics principles govern action in the domain. In the cyberspace domain, the electromagnetic spectrum is the maneuver space also governed by laws of physics. That domain is a physically manifested space with closed/wired segments as well as freespace segments. Just as the boundaries between air and space can be blurred, cyberspace can occur within the other physical domains. Cyberspace should be recognized as a physical domain, occurring any place where the electromagnetic spectrum and electronic systems interlink. If it is not, seams and access points could allow adversaries access, and as Gen. Keys notes, the Air Force risks fratricide as it tries to conduct operations in the domain.