Precision cyber weapon systems: An important component of a responsible national security strategy?

ABSTRACT

Given the advances made in conventional weapon capabilities, precision should by now be the accepted and expected norm in cyberspace as well. In this article I argue that developing precision cyber weapon systems, to be used during a lawful conflict, can be an important part of a responsible national security strategy to reduce the amount of violence and physical destruction in conflicts. I first describe a precision cyber weapon system in a military context. I then present three compelling rationales for the development of precision cyber weapon systems based on ethical, operational, and financial considerations. To support the position, I address several arguments that have been levied against their development. Thereafter I present several recommendations for a way ahead.

KEYWORDS:

• Precision
• cyber war
• ethics
• cyber weapons
• cyber security
• effects based operations

Acknowledgements

I am grateful for the technical assistance of cyber security expert Jeffrey Carr to ensure the technical feasibility of example capabilities. I am also thankful for comments received on earlier versions of the manuscript from Jordan Thomas. Finally, I am tremendously thankful for the insightful comments and recommendations provided by two anonymous reviewers of this journal.

Disclosure statement

No potential conflict of interest was reported by the author. The views expressed in this article are those of the author and do not reflect the official policy or position of the Department of Defense or U.S. Government.

Notes on contributor

Forrest Hare is a retired Colonel in the United States Air Force having served most recently at the Defense Intelligence Agency as the Deputy for the Indo-Asia Pacific Regional Center. He has served at the U.S. Embassy, Kuala Lumpur, as the Air Attaché to Malaysia. While assigned to the U.S. Air Force’s Air Staff Operations Directorate in the Pentagon, Dr. Hare was chosen to be on the Air Force's Cyberspace Task Force to develop the vision for the Service’s operations in its newest operating domain. His work contributed to the creation of new cyberspace operations doctrine. After this assignment, he served on the staff of the Office of the Secretary of Defense and was a drafter of early Department of Defense Cyber Security policies. Dr. Hare has also served at the National Security Agency and has taught several graduate and under-graduate courses in cyber security policy, economics, and geography.

ORCID

Forrest B. Hare http://orcid.org/0000-0001-5655-9119

Notes

1. The author’s assertion here that the activities are distinctly different is not an attempt to minimize the importance of intelligence gain/loss considerations during cyberspace operations.

2. Eventually, the promotion of precision cyberspace weapons could become a stated policy and not just an accepted strategy. However, this step leads to additional political arguments into which I choose not to enter here.

3. The adage that “tracers go both ways” is especially true in cyberspace. Co-locating responding and defending operations on networks physically and logically is a certain way to invite retaliation against friendly systems.

4. For a detailed discussion of C2 methodologies, see Owens et al. (2009).

5. For a more comprehensive comparison between cyber and kinetic precision-guided munitions, please see Acton (2017).

6. For a detailed discussion of the technology behind a BGP attack, see Gavrichenkov (2015).

7. Whether or not trained operators or even lawful combatants conducted this attack, a strong case could be made that this offensive operation was a LOAC violation, since it was an unprovoked hostile act.

8. For a contemporary collection of writings on the ethics of cyber conflict, refer to Allhoff, Henschke, and Strawser (2016). Sharp (1999) conducted an early review of legal aspects of cyber conflict, and his opinions have been largely endorsed by Schmitt (2013).

9. Perhaps Blueland could have reverse-engineered the payload from an earlier Redland attack on Blueland’s power system.

10. Some, like Dunn-Cavelty (2012), are skeptical of national agendas in the domain, and they argue that governments are exploiting the hysteria surrounding perceived risks. In either case, they call for a ban or at least a treaty restricting military activities in cyberspace.

11. See, for example, Denning (2001), Lin (2010), and Arimatsu (2012) for detailed discussions on this topic.

12. The astute reader will remember that, although the Russian government has yet to acknowledge their actions in cyberspace, there is strong evidence they have been one of the most active actors in the domain militarily.

13. The concern about a professional military developing and employing cyber weapons with indiscriminate effects seems implausible. Without any knowledge of the specifics of current cyber weapons programs, one would still have to wonder why a modern military, themselves highly dependent on the domain, would want to employ a weapon that would undoubtedly lead to severe fratricide on both their military operations and possibly the entire economy of their own nation.

14. For a detailed characterization of cyber collateral damage, see Bertoli and Marvel (2017).

15. The obvious exception has been efforts to reduce nuclear weapon stockpiles, but this was achieved by extensive treaty negotiations, and the weapons are in a class by themselves that all agree should be reduced as much as possible.

16. One could make the argument here that an effective cyber reconnaissance capability to monitor adversary militaries actually reduces the occurrence of a cyber security dilemma rather than contributing to it.

17. Of note, the proposed way forward does not include measures to declassify programs, as that would generate unacceptable risks to the capability and potentially exacerbate their transitory nature.