State Sponsored Cyber Conflict: Politics By Other Means Requires Political as well as Technical Solutions

Vats of newspaper ink have been spilled about what are generally accepted to have been State Sponsored Cyber-attacks against companies and governments around the world.  Some of these attacks include the DDoS attacks against the U.S. Banking System; attacks against Japanese Banks and other companies operating in China; the attack against the Saudi Aramco computer system; the infiltration of the networks of The New York Times, The Wall Street Journal, and The Washington Post by China; Stuxnet; and the regular reporting of advanced persistent threats achieved by multiple countries into other country’s cyber networks. These events demonstrate a gap between current cyber security practice of addressing symptoms such as an attack or infiltration, and the actual chronic problem confronting the entire cyber domain: State Sponsored activity in cyber is an attempt to achieve a political outcome. Cyber Security is a component of National Security and must be addressed as such rather than in isolation.

The problem is not simply a technical problem resolvable with a technical solution.  No matter how many firewalls, NetFlow tools, network infiltration reports, trainings on how not to click on spear fishing attacks, and attempts to stop social engineering take place, the problem will continue to exist.  Every effort at countering the problem through these technical approaches will continue to meet with at best mediocre temporal success with diminishing returns over time. Cyber-attacks by State Sponsors may be slowed, but will not be stopped technically. These events represent political initiatives by the state sponsor, and thus are a political problem that will only be overcome through all levers of politics. 

Although Cyber is a relatively new domain for warfare, it is still just another way to achieve politics by other means. Looking at each of the cases mentioned above one can draw a direct link between a political objective by the state actor sponsoring the cyber event to the event itself.  For the DDoS attacks against the U.S. banks this was a way for (presumably) Iran to inflict harm on the United States economy in a tangential enough way to counter the sanctions on Iran without suffering a kinetic response. The attacks on Japanese banks and other companies operating in China was due to an ongoing territorial dispute and very negative history between China and Japan over the Daiyu/Senkaku islands. The attack against Saudi Aramco was an attempt by (presumably) Iran to do economic harm to Saudi Arabia due to Saudi support of the rebels in Syria who are fighting against an Iranian supported regime. The infiltration of major U.S. newspapers (which most likely did not stop at the ones listed here, or even in the U.S.) was an attempt to both find sources for information that could discredit Communist Party leaders in China, and to potentially blackmail the newspapers into refraining from reporting negatively on China in exchange for continuing their operations. Stuxnet, as has been widely reported, was an attempt to stall the Iranian nuclear program. The list goes on, but the point should be clear.  Each cyber event was an attempt at achieving a particular political outcome.  These attempts were likely not the only means by which the state sponsor chose to attempt that outcome, but simply one of possibly several domains in which actions were taken to achieve the desired results.

There is a parallel in history that demonstrates the point I am making very well.  Before World War II much ink was spilled discussing the threat that bombers posed to countries.  The experience of World War I showed that aircraft could have a devastating effect on a country.  The inter-war years brought out new technology and capabilities to the point where most public opinion was that the new threat posed by the Bomber was unprecedented and that war should be avoided out of fear of the destruction that bombers would cause.  What was missed in these calculations, especially for France in its preparations for World War II, was that bombers were a tool used in a new domain of warfare (the air), but that the strategic objectives of the country (a stable Europe) far outweighed the threat of this one tool. France and the United Kingdom surrendered Czechoslovakia for fear of a war, driven by a fear of German bombers. When war did come, and the German bombers were dropping their payloads over France and the United Kingdom, they caused extensive damage, but a funny thing happened.  Yes, they were somewhat effective, but they did not destroy the country or its ability to fight.  Even the allied 24hour bombing of Germany later in the war did not destroy that country, or even reduce its production capability to support the war effort until 1945 when the country was occupied by ground troops.  The fear instilled in this one new domain had been proven to be far beyond the value that domain had as compared to the other domains of achieving strategic political outcomes.  Today the bomber is a component of the nuclear triad for several countries, but a fading one as new means by which to achieve the same or better results are available.

What this says is that addressing cyber through technical means, although very important on a tactical basis, is not an answer at the operational or strategic level.  Operationally, companies and countries need to at least understand who is interested in them and why; opening this situational awareness far beyond the cyber network into every aspect of the organization’s or country’s operations wherever these take place.  Strategically, organizations and countries need to focus on the outcomes they desire to achieve.  The means by which they achieve those outcomes will include the cyber domain from here on out. Yet, there are multiple other domains, to include: Public Affairs, Diplomacy, Defense, Disaster Response, Development, Track 1.5 and Track 2 interactions. Addressing political differences through all of these domains at the same time, depending on which set is most effective for that particular issue and time, will be a far more effective approach to solving cyber security problems in the long-term than any technical only approach.

It is only through integrating the technical approach tactical solutions available with the operational and strategic level perspectives of achieving desired outcomes through all means available, can an organization or country truly attain security; with the cyber component playing a contributing, but not exclusive, role.