Anti-war and the cyber triangle : strategic implications of cyber operations and cyber security for the state

[From the introduction:]The main driver for this choice of research was the growing influence of Internet-related issues in contemporary politics in various fields. 2009 saw an intensification of this link between information and communication technologies and international relations, particularly in the field of intelligence and military, with the revelation of notorious cyber operations such as AURORA, Ghostnet and Night Dragon (see chapter II). While those events started to attract the broader attention of academics, it was not until the discovery of the Stuxnet malware in 2010 (see chapter IV) that the issue gained momentum in other fields as well. A computer malware targeting a nuclear enrichment facility in a foreign country amidst a latent conflict certainly raised a lot of questions that demanded answers. Its sophisticated design and potential implications for international relations as well as strategic studies was one of the main inspirations for this research.While the emergence of literature on espionage and sabotage in conjunction with the Internet can be traced back to the 1990's, Kello recognises that even in 2013 it remains a weakly developed area, stating that '[t]he range of conceivable cyber conflict is poorly understood by scholars and decision-makers, and it is unclear how conventional security mechanisms, such as deterrence and collective defence apply to this phenomenon' (Kello, 2013: 7). Thus, the aim of this research is to contribute to the literature in this way '[…] in addition to elucidating empirical cyber events, scholars can guide the design of policies to affect them' (Kello, 2013: 38-39). Undertaking research in a field which is state-of-the-art and therefore, highly volatile, presents a particular academic challenge. It does also however enable a researcher to make a potentially crucial contribution, a dent, in the current debate. In areas of research in a vacuum exists, it is imperative for scholars to contribute to filling up that academic lacuna. The main outcome therefore is supposed to be a contribution to the academic debate on the strategic relevance and conduct of cyber operations and the state’s response to it. The intellectual tools developed as part of this research may be of future use for policy-makers. The underlying question for the research is: What are the strategic implications of cyber operations for the state?The Economist recently saw 'intensifying cyber threats' as one of the top challenges for 2014 (The Economist, 2014). The revelations of the past years, starting with Stuxnet, Operation AURORA, APT-1, Red October and activities derived from the NSA Documents revealed by whistleblower Edward Snowden indicate that this threat will not abate soon. More and more states are readying themselves for future conflicts by developing defensive as well offensive cyber operations capabilities (Lewis, 2013b: 9-55). The latest domain for conflict resolution is currently being explored and exploited too by a growing number of different stakeholders. Based on the increased number of stakeholders and the intensity and number of occurrences of said events (see section 3.5 and appendix), its contemporary relevance is high and has been increasing for several years and looks set to continue. Guiding principles in the field of strategy is an important part of this development. Though the debate on strategic implications of cyber operations started in the early 1990's, and promoted under the auspices of the RAND Corporation, '[i]ntellectually, we are in a position not unlike that faced 65 years ago as we began to develop our thinking about nuclear weapons' (Kramer, 2012: I). Nye agrees, stating that 'in comparison to the nuclear revolution in military affairs, strategic studies of the cyber domain are chronologically equivalent to 1960 but conceptually more equivalent to 1950. Analysts are still not clear about the lessons of offense, defense, deterrence, escalation, norms, arms control, or how they fit together into a national strategy' (Nye, 2011: 19). Thus, an intensive academic analysis of this field is pivotal, especially within the framework of strategic studies, in order to enable strategic adaptation and decision-making (Kello, 2013: 14). The timeliness of events, paired with the lack of a properly developed strategic framework, signify the increased contemporary relevance for research of the strategic implications of cyber operations for the state.Definitions are very important in political science, and only more so for research in the field of cyber operations. In the absence of commonly agreed upon definitions for cyber operations, and a multitude of other terms such as cyber warfare, digital warfare, information warfare, electronic warfare (see sub-sections 3.1 and 3.2 as well as section 4) which are at once related and disparate, mean that clarity in definitions is centrally important. While definitions might normally differ slightly, all elements included in the definition of cyber operations might vary. This includes the stakeholders (and their representation as entity in the cyber domain), the means to conduct cyber operations, the platform where it is conducted (for example all digital devices, Internet only, electromagnetic spectrum) and the operations through which it is conducted (for example, if cyber espionage is included or not).Therefore, the coherent and comprehensive definition is of vital importance for the understanding of the research and more so for its outcomes. The terminology of this research applies for the state in the cyber domain, cyber operations and cyber strategy. Thus, the three key definitions which are developed in this research can be found below.The state and its representation in the cyber domain is defined in chapter I: The state’s representation of the cyber domain is the Critical National Information Infrastructure (CNII). The CNII is composed of a particular part of the information infrastructure which is vital to the function of the state according to the state-teachings of Jellinek: territory, people and legitimate use of violence.The definition of cyber operations as developed in chapter II: A cyber operation is the targeted use and hack of digital code by any individual, group, organization or state using digital networks, systems and connected devices, which is directed against CNII in order to steal, alter, destroy information or disrupt and deny functionality with the ultimate aim to weaken and/ or harm a targeted political unit.Subsequently, the definition of a cyber strategy in chapter IV: The development and employment of cyber operations, potentially integrated and coordinated with other operational domains and forms of information operations, to achieve or support the achievement of political objectives

Perspectives for Cyber Strategists on Law for Cyberwar

The proliferation of martial rhetoric in connection with the release of thousands of pages of sensitive government documents by the WikiLeaks organization underlines how easily words that have legal meanings can be indiscriminately applied to cyber events in ways that can confuse decision makers and strategists alike. The WikiLeaks phenomenon is but the latest in a series of recent cyber-related incidents––ranging from cyber crises in Estonia and Georgia to reports of the Stuxnet cyberworm allegedly infecting Iranian computers––that have contributed to a growing perception that “cyberwar” is inevitable, if not already underway. All of this generates a range of legal questions, with popular wisdom being that the law is inadequate or lacking entirely. Lt Gen Keith B. Alexander, the first commander of US Cyber Command, told Congress at his April 2010 confirmation hearings that there was a “mismatch between our technical capabilities to conduct operations and the governing laws and policies.” Likewise, Jeffrey Addicott, a highly respected cyber-law authority, asserts that “international laws associated with the use of force are woefully inadequate in terms of addressing the threat of cyberwarfare.” This article takes a somewhat different tact concerning the ability of the law of armed conflict (LOAC) to address cyber issues. Specifically, it argues that while there is certainly room for improvement in some areas, the basic tenets of LOAC are sufficient to address the most important issues of cyberwar. Among other things, this article contends that very often the real difficulty with respect to the law and cyberwar is not any lack of “law,” per se, but rather in the complexities that arise in determining the necessary facts which must be applied to the law to render legal judgments

Expanding alliance: ANZUS cooperation and Asia–Pacific security

Is an alliance conceived as a bulwark against a resurgence of Japanese militarism and which cut its military and intelligence teeth in the Cold War is still relevant to today’s strategic concerns? Overview The alliance between Australia and the US, underpinned by the formal ANZUS Treaty of 1951, continues to be a central part of Australian defence and security thinking and an instrument of American policy in the Asia–Pacific. How is it that an alliance conceived as a bulwark against a resurgence of Japanese militarism and which cut its military and intelligence teeth in the Cold War is still relevant to today’s strategic concerns? The answer is partly—and importantly—that the core values of the ANZUS members are strongly aligned, and successive Australian governments and American presidential administrations have seen great value in working with like-minded partners to ensure Asia–Pacific security. Far from becoming a historical curiosity, today it’s not just relevant, but of greater importance than has been the case in the past few decades. To explore new ideas on how to strengthen the US–Australia alliance, ASPI conducted a high-level strategic dialogue in Honolulu in July this year. Discussions canvassed the future strategic environment; the forthcoming Australian Defence White Paper; budget, sovereignty and expectation risks; and cooperation in the maritime, land, air, cyber, space and intelligence domains. A key purpose of the Honolulu dialogue was to help ASPI develop policy recommendations on the alliance relationship for government. This report is the product of those discussions

Enter the cyber dragon: understanding Chinese intelligence agencies cyber capabilities

This paper argues that the nature and tempo of Chinese cyber‑activities have policy implications for the Australian government. The paper provides an understanding of the key elements of the Chinese intelligence agencies that exploit the cyberdomain. It also shows that, while cybersecurity is a concern, much media coverage tends to oversimplify the issue and not present the public with the fuller picture. 2013 is the year that cyber issues have taken on a heightened priority and strategic weight. Governments must now work out how to handle cyber matters as an element of their foreign policy to prevent long-term damage to international relationships

Something new under the Rising Sun: expanding Australia–Japan defence cooperation

A number of recent policy documents signal the Australian Government’s intent to deepen defence engagement in the Asia–Pacific, and future defence policy statements are likely to reinforce that objective. The Australia in the Asian century White Paper clearly established Asia as our primary economic and strategic focus. Australia’s first National Security Strategy gave as the first of its three priorities ‘strengthening regional engagement to support security’, and the 2013 Defence White Paper—released in May 2013—sets out an ambitious plan to strengthen defence relations with Japan. There are several factors working to make the strategic environment more uncertain for Australia and other countries in the Asia–Pacific. First, and more quickly than was expected, there’s been the emergence of a sharper-toned China–US strategic competition. Military-to-military relations, in particular, are difficult. Second, there’s a curious blending of elements of cooperation and competition in Asia–Pacific affairs. The region’s tied together by economic and trade relations, but in important respects there’s an absence of trust between countries, particularly on military matters. Third, a number of middle-sized powers are emerging with stronger voices on security matters, particularly Japan, South Korea, Indonesia, Vietnam, India and even Australia. Fourth, there’s been a broad increase in the capabilities of many regional military forces and with it the growing risk of military incidents, particularly in the maritime domain. Taken together, these developments point to an increasingly complex region where competitive multipolarity is the defining characteristic of international engagement. Even with an ensured American presence, because Australia’s resources are limited we can’t hope to achieve all of our strategic objectives in the region without engaging other players and finding innovative ways to develop a cooperative approach to building security. As the most capable of American partners in the region, Japan offers much as a closer partner to Australia. The bilateral relationship’s already strong—Japan’s now one of our closest Asian security partners

Full spectrum defence: re-thinking the fundamentals of Australian defence strategy

This report argues that successive Australian governments have failed to define an effective national defence strategy. Executive summary Australia’s inability to clearly and succinctly define its defence strategy is a perennial failing that will have serious policy and operational consequences if not addressed. Australia’s recent defence white papers are part of the problem: they lack coherence, their messaging is poor, and many of their underlying assumptions and planning practices are questionable. The forthcoming defence white paper provides the first real opportunity for the Abbott government to carry out a much-needed reset of Australia’s defence and military strategies. In place of a maritime strategy, Australia needs to adopt a “full spectrum” approach to defence that can provide protection against military threats from outer space and cyber space, as well as the conventional domains of land, sea and air. Full spectrum defence must be underpinned by deeper and broader regional defence partnerships and by a risk assessment process that encourages critical thinking about strategy and the future capabilities of the Australian Defence Force

Compelled to control: conflicting visions of the future of cyberspace

This report looks at the desire among states for greater control over the digital domain. It considers the convergence of controlling desires among the major cyberpowers and examines some of the main dynamics of the Russian and Chinese positions. Their positions are examined relative to each other and to the Western consensus. The paper analyses the potential implications for the global internet and the impact that developing countries may have on the dialogue